PDF malware analysis — malicious · fe302df32049d7c5

MALICIOUS

PDF

69.1 KB Created: 2021-04-26 21:08:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 255c1f539d225b24c31dabd4b8b030a8 SHA-1: eb98dd849725baf1eae76f5e0d27af693c86e037 SHA-256: fe302df32049d7c5de59080894c4b280d9f2a79bee4532d5421a9e2c90e0d3ba

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An embedded URI points to a suspicious domain, 'nipisod.ru', which is likely used to host a phishing page or distribute malware. The document body, though heavily obfuscated, contains references to 'Json tutorial c' and 'wkhtmltopdf', suggesting a lure to disguise malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/strik?utm_term=json+tutorial+c%2523
- http://dayzcommunity.info/rpg_maker_vx_ace_tutorial_npcszbw6.pdf
- http://cosmeteca.com/loxuziw2vdiz.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_603853dea2f2b.pdf
- https://cdn-cms.f-static.net/uploads/4426967/normal_606e22e66c122.pdf
- https://static.s123-cdn-static.com/uploads/4365539/normal_5fcab4cb1c8c9.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://lokuvutifinulef.rf.gd/dasadivi.pdf
- https://s3.amazonaws.com/jezobasit/18588535778.pdf
- https://s3.amazonaws.com/wazagidonux/how_to_refill_hp_deskjet_cartridge.pdf
- http://pirixifivojove.rf.gd/excel_formula_hotkeys.pdf
- https://s3.amazonaws.com/luropiw/41536614291.pdf
- https://s3.amazonaws.com/liguwubore/kenabojupisuxuruk.pdf
- https://s3.amazonaws.com/gebukil/74849101904.pdf
- https://s3.amazonaws.com/zobuwubedak/differences_between_harry_potter_book_6_and_movie.pdf
- http://zovameden.rf.gd/gunotukesa.pdf
- https://s3.amazonaws.com/tozaduliwubega/what_to_say_to_a_mourner_at_a_jewish_funeral.pdf
- https://s3.amazonaws.com/kugelilizibuwum/flame_candyman_album_songs.pdf
- http://tezipibuboxigo.epizy.com/dr_abdul_qadeer_khan_biography.pdf
- https://s3.amazonaws.com/gurupixabogivaz/69141638844.pdf
- http://zodejudefafu.epizy.com/data_warehousing_jobs_in_bangalore.pdf
- https://s3.amazonaws.com/fekife/tatixejalofawapav.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d16f.bin` `8b938e2d478da3f2bc12fce4825c2539c5d62fbed2c3ab1c7e249cc07edc70bb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD16F	4780 bytes
`font_01_sfnt_off0000e1b5.bin` `c21c05f1c82e054f1a0a8bccdfa3aeb0494c85e36c13179c43a27d39a02630cb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE1B5	11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.