Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f46ab0151e964b9…

MALICIOUS

PDF

81.1 KB Created: 2021-03-03 00:15:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2177d7734799732abd57c03347e95d38 SHA-1: 77f215a4f6d9fef211ac70e827eaf65acf0f8bf8 SHA-256: 0f46ab0151e964b985b53de5e873f26881d5f7fe311f7c97b23627945a409ce4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The embedded URL `https://kuzutuzo.ru/wix?keyword=your+freedom+apk+ios` suggests a lure to a website that may host malicious content or phishing forms. While no scripts were explicitly extracted, the PDF structure and the nature of the embedded URL indicate a likely attempt to redirect the user to a malicious site, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=your+freedom+apk+ios
    • http://cashbackk.site/zadufozodobirefetpmae.pdf
    • http://lanejaselisipu.22web.org/53431142784.pdf
    • http://business-open.online/dragon_age_origins_mods_how_to_installobzu2.pdf
    • http://flash-sar.online/kennedy_space_center_visitor_guidewjrgz.pdf
    • http://checkmyscore.info/what_does_seeing_644_meanlsaav.pdf
    • https://jebilazi.weebly.com/uploads/1/3/1/8/131856389/e31d380c05.pdf
    • https://sagabeju.weebly.com/uploads/1/3/4/6/134659190/wefomofujomob_vopuw_zovovakix_nukozomapisumon.pdf
    • http://small-italy.space/asus_x570_dark_hero_release_date6orrg.pdf
    • https://static.s123-cdn-static.com/uploads/4413002/normal_5fcb585ad0997.pdf
    • https://cdn-cms.f-static.net/uploads/4489052/normal_603515c358d0f.pdf
    • http://zakunofukar.iblogger.org/69670477059.pdf
    • https://vipefujalebir.weebly.com/uploads/1/3/4/7/134744486/1057400.pdf
    • http://bio-ita.fun/hero_wars_titan_leveling_guideyqenh.pdf
    • http://help-feedback-amzn6.xyz/xusiwefagiluzefasuvamefga0x.pdf
    • http://hookup671.site/72827499388b0537.pdf
    • http://vowebipuse.22web.org/88577781404.pdf
    • https://cdn-cms.f-static.net/uploads/4380393/normal_60113db81dfc3.pdf
    • https://cdn-cms.f-static.net/uploads/4365576/normal_5fd98058cb1b1.pdf
    • https://lofefogurabu.weebly.com/uploads/1/3/1/1/131164054/6875091.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://vudujufilax.epizy.com/fallout_4_ps4_trophy_guide_and_roadmap.pdf
    • http://nelodetasa.rf.gd/speaking_activities_free.pdf
    • http://wewonak.rf.gd/emulateur_android_leger_gratuit.pdf
    • http://lesodabat.epizy.com/kegoriletigade.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f307.bin
29c11829a6addb432a700eca028f373e8c00ca8b48d70048c974898aec25baea		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF307 4876 bytes
font_01_sfnt_off00010395.bin
d9afbe134ac3f58c9c951a8554a54c2d368e01ff22aaf71930704826651daffa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10395 10796 bytes
font_02_sfnt_off00012892.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12892 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.