Malicious PDF — malware analysis report

Static analysis result for SHA-256 442c0fe89e66f5c4…

MALICIOUS

PDF

80.7 KB Created: 2021-04-05 06:03:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2cbea5ceab37d379c13f9fe6af120bd0 SHA-1: 676b2ebe918715e975223c4949634e4d0a0b58ab SHA-256: 442c0fe89e66f5c4f3b749114f6102fa2a200c42e6544ab539798bac0a5048cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating it's a phishing attempt. The embedded URL `https://kuzutuzo.ru/strik?utm_term=what+type+of+poetry+is+the+raven` is likely the primary lure, directing users to a malicious site. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it may contain embedded JavaScript or exploit code to facilitate the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=what+type+of+poetry+is+the+raven
    • http://jekebes.iblogger.org/25804715598.pdf
    • http://tuwasukam.getenjoyment.net/elijah_of_buxton_summary_chapter_13.pdf
    • https://cdn.sqhk.co/lekaguko/jdq4pXD/army_physical_fitness_standards_by_age.pdf
    • https://cdn.sqhk.co/titabofasika/KFjijfl/zuwepij.pdf
    • https://cdn.sqhk.co/vilonunufuk/ajfThg9/chicken_tikka_masala_sauce_recipe.pdf
    • https://cdn-cms.f-static.net/uploads/4411935/normal_605c4a5fb8fe6.pdf
    • http://xagixowedobosab.medianewsonline.com/oraciones_en_ingles_con_verbos_regulares_e_irregulares_en_pasado_simple.pdf
    • http://mavedelusudefiv.22web.org/22417287792.pdf
    • https://cdn-cms.f-static.net/uploads/4387938/normal_6041d8dd9f203.pdf
    • https://cdn.sqhk.co/kufiremikaf/hhjuiUh/clocktower_animal_clinic_lincoln_ne.pdf
    • https://cdn.sqhk.co/fovipobex/c8tZ7Rc/hachi_movie_japanese.pdf
    • https://cdn-cms.f-static.net/uploads/4402706/normal_601ecc93a23a5.pdf
    • https://static.s123-cdn-static.com/uploads/4444102/normal_5fe31a74bb5d6.pdf
    • http://poliredebelokaz.22web.org/is_site_reliability_engineer_a_good_job.pdf
    • https://cdn-cms.f-static.net/uploads/4466391/normal_600ea4e2b0f70.pdf
    • http://kidunotofonaxiz.22web.org/journal_articles_free.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d5349546-ded5-400d-ae50-172d6ba0e5b3/96702126781.pdf
    • http://vometavofol.epizy.com/listening_worksheet_for_grade_7.pdf
    • http://poxemibusap.epizy.com/banking_service_chronicle_august_2020.pdf
    • https://uploads.strikinglycdn.com/files/34b33d4b-91df-4a89-8314-8150c9215c29/what_is_olafs_birthday.pdf
    • http://zenakezogutomu.onlinewebshop.net/best_ebook_reader_2020.pdf
    • https://uploads.strikinglycdn.com/files/b8f0a20a-e500-4d9b-a007-48daa7a981cc/38387951155.pdf
    • http://gakinodimojulat.rf.gd/21756994252.pdf
    • http://miwofalixi.rf.gd/pakug.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010095.bin
14de71f6b14314910ffe9beed78916874699453a43b50d88b77c9d3b44bc54c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10095 5132 bytes
font_01_sfnt_off00011222.bin
a1002f99789a0561e9cbcb17d68614e0e5cb5680686d339e759b2bdd81a22977		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11222 10716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.