Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb53f349048a0533…

MALICIOUS

PDF

97.9 KB Created: 2021-03-17 02:36:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e22aec353284d35b788066cc27951cc1 SHA-1: bd90ec5a2d0b0a82bca90c310045203cec369cab SHA-256: eb53f349048a05334c4c186b6c4a84cdd4e005e85a6defc81754f661864c4d29
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains text related to 'Windows 7 activator status unsupported partition table', suggesting a lure for users seeking activation tools. The embedded URL 'https://nipisod.ru/wix?keyword=windows+7+activator+status+unsupported+partition+table' likely hosts the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=windows+7+activator+status+unsupported+partition+table
    • http://doucheapp.xyz/wikimodiroluzuditebiwira4e8tk.pdf
    • https://cdn-cms.f-static.net/uploads/4418558/normal_60342ada0ad68.pdf
    • http://natorg.fun/chicco_keyfit_30_car_seat_installation_without_base5tjrs.pdf
    • http://helplnstagramcontact6088758.com/what_do_green_tree_frog_eattia5r.pdf
    • http://ooovseanalizi.ru/2nd_grade_2_step_math_word_problems_worksheetyoiz2.pdf
    • https://cdn.sqhk.co/papowepu/bK7Wjdh/lezejusego.pdf
    • https://static.s123-cdn-static.com/uploads/4485589/normal_5ffe88cee3294.pdf
    • https://cdn.sqhk.co/fakupavod/gigh1hg/stadia_pro_games_september.pdf
    • https://cdn.sqhk.co/jogepirar/hjScCyj/92327691830.pdf
    • http://arendagg.xyz/formato_carta_poder_simple_word_gratisufrn3.pdf
    • https://cdn-cms.f-static.net/uploads/4530578/normal_602977f4e5523.pdf
    • https://static.s123-cdn-static.com/uploads/4425919/normal_5fcf17bad4b94.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dofurorumilu.epizy.com/new_malayalam_audio_songs_free.pdf
    • https://uploads.strikinglycdn.com/files/b6a7c441-951c-43af-9b44-c02505f9c19a/misigupiputix.pdf
    • https://uploads.strikinglycdn.com/files/c888d652-10f9-4379-8bf9-d2d81bc78d3b/what_jobs_can_i_get_with_an_associates_degree_in_computer_networking.pdf
    • http://bajivuselome.epizy.com/83328986379.pdf
    • http://zuriromaruwo.epizy.com/free_simple_loan_agreement_template_australia.pdf
    • http://nanesipub.rf.gd/tokigegatudizunawonujoru.pdf
    • https://uploads.strikinglycdn.com/files/526d38ea-01d4-4c78-a1fb-d96759c22fb0/a_vce_pro_crack.pdf
    • https://uploads.strikinglycdn.com/files/8e373ef9-e777-4d9d-8b18-60a04de3cefa/63666003841.pdf
    • http://suxanovovogemi.rf.gd/gidufidalut.pdf
    • https://uploads.strikinglycdn.com/files/a20fde38-fa10-46a2-83f4-ac2d53acf15f/clasificar_los_nmeros_en_nmeros_enteros_racionales_e_irracionales_brainly.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013c0a.bin
1eee38f660a4590887d646a582d7b5e2c7a61e6e70599164d58e9632634e0c6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13C0A 5452 bytes
font_01_sfnt_off00014ebc.bin
4878e8eeb469f5c2b524d217532e0fa13d1823d710aa531704b6919f2f7df096		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14EBC 12760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.