Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0d3a34cc75ec584…

MALICIOUS

PDF

80.8 KB Created: 2021-04-04 20:44:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95fd7c926e01028e85f6170584bbf140 SHA-1: 0165f93c3c0ee90e9bd335d45348467f2bd3512e SHA-256: e0d3a34cc75ec5843b1b51ede33d6e5ec42aba7766fb8ada9bdc340398aa011a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to a book chapter. The presence of numerous external URIs, including the primary one at 'lozipotod.ru', indicates an attempt to redirect the user to malicious content or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/aws?utm_term=watsons+go+to+birmingham+chapter+15
    • http://roxedizusugu.mywebcommunity.org/mthode_de_dosage_de_la_cratinine.pdf
    • http://fofajofafe.iblogger.org/arabic_alphabet_worksheet.pdf
    • http://zisuroto.mygamesonline.org/how_much_do_emergency_room_doctors_make_in_california.pdf
    • http://fafesixokegigi.getenjoyment.net/hp_photosmart_7525_fax_instructions.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rokipegokibaf.rf.gd/ap_total_budget_2020_20_in_telugu.pdf
    • https://s3.amazonaws.com/pivetuzadujo/tepeminonofetoxidotug.pdf
    • http://jipudovisubu.rf.gd/nivigupajuj.pdf
    • https://s3.amazonaws.com/pusixa/arjun_pandit_film_songs.pdf
    • https://s3.amazonaws.com/litunux/85928991219.pdf
    • http://tinejamuwaki.epizy.com/elevador_de_tijera_hidraulico_casero.pdf
    • https://uploads.strikinglycdn.com/files/40d7cef1-087e-4dd9-8f96-1b664be26826/digital_humanities_italia.pdf
    • https://s3.amazonaws.com/memobofilenabon/les_miserables_cast_2019_michael_ball.pdf
    • https://s3.amazonaws.com/gavapozalilup/26066562219.pdf
    • http://legibevisavu.epizy.com/63001553950.pdf
    • http://fobegakolu.epizy.com/terraform_azure_storage_account_v2.pdf
    • https://s3.amazonaws.com/bawalidamovidud/calvary_temple_jesus_songs_free.pdf
    • http://xebenuxod.rf.gd/cartel_polaco.pdf
    • https://uploads.strikinglycdn.com/files/6034f28a-564a-42f5-8888-cd09f39702a5/how_to_use_jitterbug_smart_2_camera.pdf
    • https://s3.amazonaws.com/wegemebufojafak/samsung_a30_actualizara_a_android_10.pdf
    • http://bufisilozo.rf.gd/rubigemijujaso.pdf
    • https://uploads.strikinglycdn.com/files/bd7bec26-0962-4d20-951e-a0ea65c15f8c/59989127865.pdf
    • https://uploads.strikinglycdn.com/files/38494a8a-fc56-48b8-9036-bad37543ac3d/59819846768.pdf
    • http://xuvuzonixo.onlinewebshop.net/39372008374.pdf
    • https://s3.amazonaws.com/dotivaf/2595792238.pdf
    • http://zikinevubebera.epizy.com/us_army_survival_school.pdf
    • https://s3.amazonaws.com/woneketelak/zuxiriva.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc4a.bin
848dc01ce3db738ec8d44cb01d6b138dbe6770c0bdffab2a6c85f9d9313f7cc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC4A 5644 bytes
font_01_sfnt_off00010f6a.bin
928d03d2b3ba98806d53665d1fb253d42a3365f88b5d18abf672e297551e7f0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F6A 10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.