Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c8b9ba6c5a5756c…

MALICIOUS

PDF

163.6 KB Created: 2021-03-03 23:22:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5136fa425b08399d66726bcd2644fa0 SHA-1: 219c0d730cf16080dfea873a2c540d8556f7aea5 SHA-256: 1c8b9ba6c5a5756c10d99427396193b643636ec4c54b6e5f750abbf2d9d1cd6f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, mezovuduw.ru, which is presented as a search result for a specific book. This suggests a social engineering tactic to trick users into visiting the malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=principles+of+biochemistry+4th+edition+voet+pdf
    • https://cdn-cms.f-static.net/uploads/4446272/normal_602d05152a0dd.pdf
    • http://prizinsta24.site/jojupewufefezexusolenegu1st3z.pdf
    • http://okstore.info/toca_life_neighbourhood_aptoidecs6tr.pdf
    • https://gaduforijap.weebly.com/uploads/1/3/1/3/131381464/5044410.pdf
    • http://ilkertr.shop/allison_transmission_manual_valve_body5myfb.pdf
    • http://wanikagupefurav.22web.org/mfj_993b_tuner.pdf
    • https://leditolovon.weebly.com/uploads/1/3/2/6/132682688/vilomo_zuzetozura_nutemirixodoxab.pdf
    • https://vudelugofede.weebly.com/uploads/1/3/4/3/134383428/23b24b2d8e.pdf
    • https://cdn-cms.f-static.net/uploads/4451210/normal_6031c3120be0f.pdf
    • http://jafedaroz.iblogger.org/wahls_protocol_diet_plan.pdf
    • http://xitabijasava.getenjoyment.net/glacier_bay_faucet_installation_instructions.pdf
    • https://static.s123-cdn-static.com/uploads/4375073/normal_5fc5ef45095d4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gafizojuxibido.epizy.com/75441071946.pdf
    • http://gerutijotinana.rf.gd/addition_and_subtraction_worksheets_year_4.pdf
    • http://situwosase.myartsonline.com/38046397049.pdf
    • http://sixuvurubemile.rf.gd/sinox.pdf
    • http://firasakujataj.epizy.com/jilupugaxuwojekakin.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021afa.bin
88deb5dfaf7dceda09928bb19b89de3a5c9a34a6b4e7f3b3954c1d051e784696		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21AFA 5576 bytes
font_01_sfnt_off00022dd4.bin
456a04f1f12a7c92e6a5e1c6f88de5c84b408f82f932a219463a663aac77d29b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22DD4 14648 bytes
font_02_sfnt_off00025b85.bin
caea212bfaaf2897f4851770f673d25c90b0e412378cb4b0d6f36fafa9739068		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25B85 16072 bytes
font_03_sfnt_off00027023.bin
820851b731abc509e86fd424ecb961d9d709cc5bf8777c35c00b4009ecb0103c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27023 6076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.