Malicious PDF — malware analysis report

Static analysis result for SHA-256 f839c17089bf3b17…

MALICIOUS

PDF

82.4 KB Created: 2021-03-14 14:58:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24aa7ba7c9ad6bc423da4e168f602e77 SHA-1: e42503c90355200b66b810ba614b4f3c5d766eda SHA-256: f839c17089bf3b17eeecc380bf3f36b4823b6cfee96dd69131585eb500e83d08
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically 'https://lozipotod.ru/award?keyword=bass+guitar+lessons+for+beginners+pdf'. This URL is presented within the document body, disguised as a legitimate PDF download. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=bass+guitar+lessons+for+beginners+pdf
    • http://xomunuxeju.sportsontheweb.net/halloween_worksheets_esl.pdf
    • http://kenugizi.getenjoyment.net/south_carolina_dmv_permit_test_practice.pdf
    • http://sodofuwaxidida.22web.org/is_sig_a_good_gun.pdf
    • http://wijalejumodu.22web.org/untitled_goose_game_pub_guide.pdf
    • http://rixorevu.getenjoyment.net/can_i_substitute_vinegar_for_keurig_descaling_solution.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d4d87ff3-18f3-4eb0-beba-3f903636aba4/denotulodixem.pdf
    • https://uploads.strikinglycdn.com/files/94c58b32-5811-475e-9cfb-77de230a9e2f/economic_loss_doctrine_definition.pdf
    • http://sedijinuv.epizy.com/cch_ci_theme_ios_cho_android.pdf
    • https://uploads.strikinglycdn.com/files/c1dbfc8f-e59b-42e2-8fc5-7a21dd7d5cd3/moripeva.pdf
    • https://uploads.strikinglycdn.com/files/fd62f1bc-58cc-460e-8615-83a9149bb2f2/doxemetoxamilukefidivupa.pdf
    • http://kipamorilezux.epizy.com/9319106667.pdf
    • https://uploads.strikinglycdn.com/files/2a9789b5-39c5-4773-ad21-ffdbf19a5914/24365934507.pdf
    • https://uploads.strikinglycdn.com/files/4d26993b-b905-4543-ab66-2ce7dd910d6a/ge_xl44_parts_manual.pdf
    • http://xavisijividefo.epizy.com/fisuxexotelovubagej.pdf
    • http://ziwivazud.onlinewebshop.net/how_to_program_radio_shack_remote.pdf
    • https://uploads.strikinglycdn.com/files/3a8a60be-ad5b-43c3-848a-209f5d194e43/planet_eclipse_etha_2_paintball_gun.pdf
    • https://uploads.strikinglycdn.com/files/cc482284-45da-4bb9-aaf1-5053185724b5/buzowop.pdf
    • https://uploads.strikinglycdn.com/files/f97488b8-aa76-4ed2-b22f-81d352dea8f6/how_to_get_1098-e_student_loan_interest.pdf
    • http://vilepobafomunow.atwebpages.com/samsung_grand_prime_pro_battery.pdf
    • https://uploads.strikinglycdn.com/files/a783f2d4-a5a1-4bc2-968d-f071f6af619d/how_to_increase_public_speaking_skills.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102ba.bin
8e579f4be42952807ab1a05c699da1a6aca3eb13a4aeb8d7faa1d0a8b7614473		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102BA 5396 bytes
font_01_sfnt_off0001151d.bin
2d2e3d1ce27bd96b8a4e951a88cf5e4ee9b39fb17cb5a1c8e2d41aa8c68a0d1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1151D 11136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.