Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd9967cee7dc8162…

MALICIOUS

PDF

91.9 KB Created: 2021-03-13 15:48:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb0e2c2759eed2749ac5e934e35133ee SHA-1: 75ef554e1b4a059ca92a882c657916a097785e3d SHA-256: fd9967cee7dc816272153082a2536166ad60a13a2ed12d909570ee153a7d08ed
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'lozipotod.ru', which is likely a malicious domain used to host phishing content or distribute further malware. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a movie title, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/aws?utm_term=helter+skelter+movie+watch+online
    • https://cdn.sqhk.co/sunomedude/gijg8I9/cosmos_a_spacetime_odyssey_questions_and_answers.pdf
    • https://cdn.sqhk.co/mewoveri/jbgieqV/shaolin_kung_fu_master_new_york.pdf
    • https://cdn.sqhk.co/dorusafe/4gjhgvP/62188022084.pdf
    • https://cdn-cms.f-static.net/uploads/4459326/normal_60484292d697a.pdf
    • https://cdn-cms.f-static.net/uploads/4379222/normal_60209433c5b37.pdf
    • https://cdn.sqhk.co/wudawagirus/GP2jhNC/jojo_friend_fake_video_call_on_facebook.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/visagogijulep/nisanikobitaguxekifav.pdf
    • https://s3.amazonaws.com/wemazun/83938558577.pdf
    • https://s3.amazonaws.com/kovezodepugov/florida_boater_education_temporary_certificate_answers_2019.pdf
    • https://uploads.strikinglycdn.com/files/8a8a6cc0-2f5b-4138-b3fd-c5447a8024c3/cbt_workbook_for_depression.pdf
    • https://s3.amazonaws.com/sugowubuf/faxavamalumaziwebadibojib.pdf
    • https://uploads.strikinglycdn.com/files/51873831-2618-4600-80a2-c62a2e9fd940/ronuvipuwutubifavuf.pdf
    • https://uploads.strikinglycdn.com/files/32edd64e-cbf2-49e6-885b-d9f858b1966c/nuvusu.pdf
    • https://uploads.strikinglycdn.com/files/7db47cb1-962b-43b0-9112-f6dcc68b1593/how_does_swiss_wealth_tax_work.pdf
    • https://uploads.strikinglycdn.com/files/9b8dcccd-9cd9-4bfb-8a45-a265022443c4/lolali.pdf
    • https://uploads.strikinglycdn.com/files/bc4aea53-0882-4148-8312-71b67f7bc703/zozirogedikijoz.pdf
    • https://uploads.strikinglycdn.com/files/5873cd71-ef62-4522-8b5b-471a59cdb280/canon_mg6320_ink_absorber.pdf
    • https://uploads.strikinglycdn.com/files/3de2ca84-eea2-48bb-84f0-83be421e994c/pioneer_sph_da210_installation_manual.pdf
    • https://s3.amazonaws.com/pevuwarobuvowa/ielts_reading_sample_with_answers.pdf
    • https://s3.amazonaws.com/gorajikunobixi/xaxoraki.pdf
    • https://s3.amazonaws.com/wezukep/53038484483.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012c1e.bin
e05f0505258ed1a59bcc73ec9192f1e8965baa3d9950ff7ab6862dcf13a5bcef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C1E 5216 bytes
font_01_sfnt_off00013db9.bin
c53b56948ea557991c300a8c29675366313adb1c3f532f3dfd3317b160c81ca9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13DB9 10728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.