Malicious PDF — malware analysis report

Static analysis result for SHA-256 499d26156a3d0489…

MALICIOUS

PDF

74.9 KB Created: 2021-04-12 22:11:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f9e627388a3f19b5bd3d327b3da54893 SHA-1: 98b89100dd4f425b2769be8a90824ddc42caa2b3 SHA-256: 499d26156a3d0489c782ce50021c4fc4d36abab0e9e47a5ec33740cb3ef3ec7c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan payload. It contains numerous external URIs, including one pointing to 'kuzutuzo.ru/strik', suggesting an attempt to redirect the user to a malicious site. The document body is heavily obfuscated, but the presence of embedded URLs and the overall heuristic firings strongly suggest a malicious intent to deliver a secondary payload or phish for information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=molecular+biology+methods+book
    • http://wedevaz.sportsontheweb.net/pictogramme_autisme.pdf
    • https://cdn.sqhk.co/rudixika/yjiY1ib/89661108530.pdf
    • http://vemexulitoko.iblogger.org/chundari_vave_song_kuttyweb.pdf
    • http://pafowitowa.medianewsonline.com/83528361545.pdf
    • http://gexomafe.mypressonline.com/pharmacology_books_for_medical_students.pdf
    • http://dosijaruwiteli.mywebcommunity.org/rozigaweb.pdf
    • https://cdn.sqhk.co/vobilurerire/6JMiebq/moxejumiludojox.pdf
    • http://pusedoropeseb.66ghz.com/kayarian_ng_pang-_uri_worksheet_grade_6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://52c77544-2eb8-427c-ad0e-a8a7e2ea9366.filesusr.com/ugd/93288f_efa3f3bfef06485a8d994d7e120292ce.pdf?index=true
    • http://sopolakomuz.rf.gd/aramaic_peshitta_bible.pdf
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_181ec748b98e4963b90a391b29b9a7c5.pdf?index=true
    • http://tuzajobiwazotuf.epizy.com/vizaful.pdf
    • https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_cc6b04396c55487186f529d6f537aa8e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/47796adc-e349-428d-87af-29d7a6950b7e/68274856619.pdf
    • http://xawiponifazu.epizy.com/zedizisititobegulodulol.pdf
    • https://uploads.strikinglycdn.com/files/bc01a0e4-e9cb-4860-97c7-896227fa54bf/ap_art_history_memes_twitter.pdf
    • https://uploads.strikinglycdn.com/files/191961f9-0ba0-44fd-873a-7f60f9c36ce3/what_is_the_symbol_for_wind_on_the_weather_channel.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e721.bin
cff44f815d6f7a8ca81be42ec9bd2bc67b2c25e6ab18229cc0c75ff577069c7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE721 5664 bytes
font_01_sfnt_off0000fa47.bin
8abc1b3d5a879f5b00045b91311bb94f58193b2159ee5632a2ce1633bd430925		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA47 10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.