Malicious PDF — malware analysis report

Static analysis result for SHA-256 52350055b1cb8e19…

MALICIOUS

PDF

78.7 KB Created: 2021-03-31 22:58:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f129cddbe5063323f99af5fafaeb97b SHA-1: dcd21c7eb8298f75c2ce5708ab79898ad186515b SHA-256: 52350055b1cb8e192328df6071360f07cf02d20933d2d23fb028efa1366f9ea2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'https://kuzutuzo.ru/strik?utm_term=how+to+multiply+two+excel+cells', which likely serves as a lure. Numerous other unknown reputation URLs are present, suggesting a phishing or malware distribution campaign. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of external links and the overall malicious verdict strongly indicate a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+to+multiply+two+excel+cells
    • http://antonioit.fun/teas_v_study_manual_free6by4v.pdf
    • http://jinobuzid.scienceontheweb.net/agricultural_research_institutes_in_nigeria.pdf
    • http://pasetbs.xyz/occupational_safety_and_health_administration_osha_malaysiazrbn3.pdf
    • http://jobs-ingenieur.best/wujirod37t8.pdf
    • http://ericksandoval.com/fadazh8785.pdf
    • https://cdn-cms.f-static.net/uploads/4366957/normal_600ae648b561a.pdf
    • https://cdn-cms.f-static.net/uploads/4418570/normal_6014582bcf7d6.pdf
    • https://vakitisize.weebly.com/uploads/1/3/4/0/134017930/vilibumesudobivobazo.pdf
    • https://pigamudabuv.weebly.com/uploads/1/3/4/2/134235231/b323bca10146f84.pdf
    • http://bigpleasure.ru/warcraft_classic_alchemy_leveling_guidetvui2.pdf
    • http://larebalin.mypressonline.com/21568999746.pdf
    • https://static.s123-cdn-static.com/uploads/4405190/normal_6006d43c2584f.pdf
    • https://cdn-cms.f-static.net/uploads/4408343/normal_603f26a249392.pdf
    • http://sewawena.scienceontheweb.net/aprendizaje_basado_en_proyectos_autores.pdf
    • https://zavebunerug.weebly.com/uploads/1/3/4/3/134358754/gavawuputevupajimaso.pdf
    • https://finepeva.weebly.com/uploads/1/3/5/3/135347337/puxesi.pdf
    • http://mifirejetevina.getenjoyment.net/kotter_1995._leading_change_why_transformation_efforts_fail._harvard_business_review.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://muvipej.atwebpages.com/cesur_yeni_dnya_turuz.pdf
    • https://uploads.strikinglycdn.com/files/e4f2c7c8-ed68-4ce8-b1e2-b32b0974f370/reset_samsung_qled_tv_without_remote.pdf
    • http://kojatez.rf.gd/28692035295.pdf
    • http://nifekubipaxo.epizy.com/20522654726.pdf
    • https://uploads.strikinglycdn.com/files/372f2dfb-d442-4065-8714-f9b8fd00009d/how_to_find_the_latitude_and_longitude_of_your_address.pdf
    • https://uploads.strikinglycdn.com/files/e3f50eec-2977-4260-8c7c-bb15c7259954/81560210117.pdf
    • http://puwilibu.epizy.com/zuzuxu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f446.bin
ae2688b0655e425c940c4eecaa3ffaff80612974899425e4154535518e05e75b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF446 4996 bytes
font_01_sfnt_off00010558.bin
686762f1ddfeb5c3bd9089265f0577f5cc5ff01fd3ca2eaf26044047dc786a93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10558 11880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.