Malicious PDF — malware analysis report

Static analysis result for SHA-256 18f5650d44e22f72…

MALICIOUS

PDF

96.3 KB Created: 2021-05-05 11:54:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c1fc30870eda43c14b8f61bd76d4bd53 SHA-1: 73189bd5f8a26c6233fb593b351fb2e079e625fd SHA-256: 18f5650d44e22f72b7d51732fc982aa2c79041abad667ec0ea584d56255efd78
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous embedded URLs, with one prominent URL pointing to 'kuzutuzo.ru' which is likely part of a link farm designed to redirect users. The document body, though partially corrupted, suggests a lure related to salary information, a common tactic for phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+much+does+a+mechanical+engineer+make+in+dubai PDF link annotation
    • http://renijulemigato.iblogger.org/mizobegi.pdfIn PDF document text
    • http://sozapemogoz.mygamesonline.org/wozig.pdfIn PDF document text
    • http://mujododaziwato.scienceontheweb.net/basic_music_arrangement.pdfIn PDF document text
    • http://edaruzal.xyz/rifawegodubovudixogegayi8cn.pdfIn PDF document text
    • http://fodosokidorakig.22web.org/categorias_gramaticales_2_eso.pdfIn PDF document text
    • http://usejus.club/ignition_temperature_definitione5jrs.pdfIn PDF document text
    • http://sethel.xyz/who_invented_the_moon_roversg93k.pdfIn PDF document text
    • http://zoomita.space/under_the_dome_movie_streamingdbpaq.pdfIn PDF document text
    • http://kiritisivasol.mywebcommunity.org/52103380951.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/c2de9903-dd0f-4d98-94aa-97518021c085/gomuzabizopuwa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9a9a5f5-414b-4957-bf46-a476016598be/timberline_wood_stove_for_sale.pdfIn PDF document text
    • http://xatofobimuxu.rf.gd/how_to_go_to_facebook_support_inbox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca57cf6e-2bf6-48a3-83f1-cf7eb3415d2a/how_do_you_find_a_line_of_best_fit_on_desmos.pdfIn PDF document text
    • http://perezibef.rf.gd/nida_audition_monologues.pdfIn PDF document text
    • http://pejemevogoge.myartsonline.com/biodata_sample_form.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c68ec834-d013-4efd-8e5f-98b9c1a33385/elementary_the_price_of_admission_full_cast_and_crew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea174489-342e-40b8-a0c0-add8e572ff96/86903106828.pdfIn PDF document text
    • http://bejopirobi.epizy.com/niv_audio_bible_offline_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/818f1296-1384-4a35-a1e1-79b8f0972320/solulinovu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e9301c7-2955-4f76-8291-b4fa32a14973/9728115297.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dcc33f9f-4457-41f6-9d84-bc9c9d6c2f1a/fl_studio_10_producer_edition_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9547f85-b875-4240-847d-e64f6412bc75/kawonupiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f727ab4-be56-4ecb-b5dd-d247aaa342e6/95644057775.pdfIn PDF document text
    • http://deguwesipi.rf.gd/kasovofirefivibani.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011337.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11337 5412 bytes
SHA-256: fcadfd5d4e49d5d7a2215b007290bdcbe4ab904ded96b551fd209adaf5daff59
font_01_sfnt_off00012574.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12574 11924 bytes
SHA-256: cc08853516cf5019a283ea5b26c1631af741b7599e7f8c211b28e3f44c583495
font_02_sfnt_off00014e6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E6D 16388 bytes
SHA-256: 850cee24db38e4b2f2c18f6eccaf0ef19728382b02d4d1a16a624b5908f369d9
font_03_sfnt_off0001649a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1649A 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.