Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd2161ded7126e7a…

MALICIOUS

PDF

79.6 KB Created: 2021-03-13 22:04:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 83a21a90bc17cf3ca42d9d69772e2a53 SHA-1: b4cb7d2c9b540070dfeef2471083eefd14c337a4 SHA-256: dd2161ded7126e7af6a4a249cf3f0e4159aeb4ccffd9ecf5ff48356b8b3e6b80
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to 'leonvi.ru', which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to 'articles on entrepreneurship education'. No scripts were extracted, but the PDF structure itself is suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=articles+on+entrepreneurship+education+pdf
    • http://tulakijumipad.22web.org/20901531662.pdf
    • http://xufamorazogubov.sportsontheweb.net/veinte_poemas_de_amor_y_una_cancin_desesperada_resea.pdf
    • http://bottlechainworld.com/87302104797yzt6t.pdf
    • http://216tilford.com/are_uk_postage_rates_going_up_in_2020sgse5.pdf
    • http://kuzososo.mygamesonline.org/alter_ego_plus_free_download.pdf
    • http://ver-alex.website/30886307961c4o9u.pdf
    • http://zakutefog.iblogger.org/63965060418.pdf
    • http://meetplafond.xyz/160727286205p129.pdf
    • http://xuzekamusudis.iblogger.org/metric_mania_conversion_worksheet_answers.pdf
    • http://dontbeshy.xyz/how_to_use_dual_power_pro_carpet_washerb30ec.pdf
    • http://igafnd.org/13780594058nx9r.pdf
    • http://magic-world.site/1422192228o2ali.pdf
    • http://mitutepoka.medianewsonline.com/29385587289.pdf
    • http://xasawidujilade.iblogger.org/buboludu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nonakiwobituk.rf.gd/sears_kenmore_canister_vacuum_power_head.pdf
    • https://uploads.strikinglycdn.com/files/d87e9ab1-ee93-4732-87d2-930ff37b3166/what_can_i_eat_to_avoid_yeast_infections.pdf
    • http://lufeneweb.epizy.com/botuvobujuka.pdf
    • https://uploads.strikinglycdn.com/files/12c2f94c-5c99-42fe-a889-a0c9ff8ca24f/tajidipe.pdf
    • http://bufisilozo.rf.gd/start_where_you_are_use_what_you_have_do_what_you_can_roosevelt.pdf
    • http://sefogozi.epizy.com/44401622691.pdf
    • https://uploads.strikinglycdn.com/files/d7eda35e-2d78-43f1-8359-c370feeaff74/89728030036.pdf
    • https://uploads.strikinglycdn.com/files/ecc310c4-0efe-4ca2-8a10-87b8376c29f8/poputenit.pdf
    • http://palelezugob.onlinewebshop.net/rhythm_strip_interpretation_for_nurses.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e287.bin
1e90ce7415599545334d90f156c305fce75c2bf3260bfce847e700d51ac03378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE287 5232 bytes
font_01_sfnt_off0000f44f.bin
1b6a57bce3fa82bd9941fcd836dbc489da80fcfb0adf07fa69de1e89688914dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF44F 11664 bytes
font_02_sfnt_off00011b73.bin
60f53b17f7925ac1818ac9336ea58fd206fea48872b5377b70e6fb8114080afd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B73 16132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.