Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ebcc1a2b8f4e21c…

MALICIOUS

PDF

79.9 KB Created: 2021-05-14 22:26:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f3326008f06cc63ed4fb54dfe3fddcbd SHA-1: e969476cab2172a8d1273c0051051006ea704959 SHA-256: 3ebcc1a2b8f4e21c8af601289f9efd61f1ff677e30fdc8315c708f92bd86207f
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The sample is a PDF document flagged by ClamAV as a phishing trojan. Heuristics indicate it uses a social engineering lure to prompt the user to install a browser extension or update, a common tactic for malware delivery. The document also contains embedded URLs, one of which, https://kuzutuzo.ru/strik, is associated with the malicious activity. While no scripts were directly extracted, the PDF format can embed JavaScript, which is often used for malicious redirection or exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=classical+guitar+tabs+reddit PDF link annotation
    • http://itanto.space/lefigugefinisusasicp5ew.pdfIn PDF document text
    • http://hangzhoumetal.ru/1396988044932fwk.pdfIn PDF document text
    • http://1xbets-reg.site/left_behind_kirk_cameron_castwlle3.pdfIn PDF document text
    • http://copyrighthelp.info/rational_and_irrational_numbers_worksheet_grade_9snv49.pdfIn PDF document text
    • http://www.classtab.org/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/fibesezati/80196335206.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23adca5b-5c53-470b-8ef1-5d58f52eae25/faxigipopabefamikik.pdfIn PDF document text
    • https://s3.amazonaws.com/wemupajese/outlook_automatic_reply_vacation_template.pdfIn PDF document text
    • https://s3.amazonaws.com/zedilegol/tintin_books_reading_order.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/096324d8-3fec-4695-8cdd-7dfb970c7846/69976755381.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b057451-8a1b-44d4-b418-336652ffbc10/bumifusubev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8e67777-bf45-4dbb-8649-c8c174c1dc5d/togikikiwij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4a55c20-8ce6-4927-b499-eb7630ac624c/jupevilijivorejuriluj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c24fe049-d120-4b92-ac8f-2eb43a017046/what_is_the_next_book_after_a_breath_of_snow_and_ashes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01992147-278d-41a5-bec4-6b4ade7083a5/vitamix_5000_for_sale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3806ee09-2629-4a30-b956-723e968a9c57/49939696697.pdfIn PDF document text
    • https://s3.amazonaws.com/wujanozo/crontab_command_format.pdfIn PDF document text
    • https://s3.amazonaws.com/viwoxuz/40661732440.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8db0a71-1ffa-4904-ae25-b3eb24f5c470/marova.pdfIn PDF document text
    • https://s3.amazonaws.com/pusori/powermax_45xp_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0eddfe54-0886-4a32-a48f-28bba35ab6a4/irregular_plural_nouns_worksheet_for_2nd_grade.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2E3 4936 bytes
SHA-256: de5b0a606883935b7571655296ae7f80ea46aa19d7d1f0e65e4c12feea3fa3c5
font_01_sfnt_off0000f3af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3AF 2012 bytes
SHA-256: 6d89c54bfef412d02a439fa103b09c01255bf205ae670ca771b2ac50906b3e4d
font_02_sfnt_off0000fd0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0F 12144 bytes
SHA-256: 51a0392e626bf3f0965df9f42e0587d9f202232a9fdb63bb206d1d85972b38ea
font_03_sfnt_off000124a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124A3 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.