Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a89e89bf082a231…

MALICIOUS

PDF

95.0 KB Created: 2021-04-01 04:04:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: ee827ba29667f2d138395a7ada6f48a4 SHA-1: ab09e591f3aab5a9612946bf6cfcc2f4ceb12c16 SHA-256: 5a89e89bf082a231f5ea69f7059754f594c0154c7c5cd30281cc34e9d0354fdf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, mezovuduw.ru, which is likely used to host a malicious payload or phishing page. The document body is heavily obfuscated and unreadable, but the presence of the external URI is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=names+of+fingers PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4446496/normal_6003eb614e8b1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446496/normal_5fdec4eee3b15.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470209/normal_602d817086e8c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408180/normal_603403dce0c76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477886/normal_60579a086d559.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386822/normal_6040fb4964e85.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465274/normal_5ff7c7632aa8c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369313/normal_5fe13641bf416.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zetubakuz/xutonexijebuleravumujaxu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f246bdaa-9163-4c3b-aa19-69622548288c/canon_mp250_printer_ink_refill_instructions.pdfIn PDF document text
    • https://s3.amazonaws.com/bisapovepizaj/24248980475.pdfIn PDF document text
    • http://girodolud.rf.gd/soundtap_streaming_audio_recorder_2._11_free.pdfIn PDF document text
    • https://s3.amazonaws.com/tokatefozude/dorapevarekutalegodix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6fcd25d0-c221-4506-ad2f-8376df66e7df/murray_lawn_mower_recoil_starter_repair.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f897a49a-b256-4d00-abe3-bd82cce406b5/best_way_to_read_watchmen_digitally.pdfIn PDF document text
    • https://s3.amazonaws.com/xefejevife/langston_hughes_harlem_tone.pdfIn PDF document text
    • https://s3.amazonaws.com/firudegix/gawuxurizuxigisatuw.pdfIn PDF document text
    • http://merojupamen.epizy.com/does_michael_corleone_kill_fredo.pdfIn PDF document text
    • https://s3.amazonaws.com/ganubatebedoxez/what_does_rhetorical_structure_mean.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8b09cdd-f05e-4bf1-b5e8-42193ae68253/diwanolakoxuturopamare.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f6ee04c-8f46-4985-9bff-f78eb0b21363/why_is_my_hayward_pool_heater_not_working.pdfIn PDF document text
    • http://gekavitominugi.epizy.com/ielts_reading_exam_sample.pdfIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/kitchenaid_mixer_ksm90ww.pdfIn PDF document text
    • https://s3.amazonaws.com/gekixadonuru/instrumentation_cable_data_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/devuxuzejozam/bloons_td_6_update_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/tixedujegibex/grade_4_maths_long_division_worksheets.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ab5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12AB5 4732 bytes
SHA-256: d088a0cdebe2a3fbf0d0727815a8612f5f2c31c72aea1125197e1648cb424c25
font_01_sfnt_off00013aa7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13AA7 11068 bytes
SHA-256: 9f5812041dd6acba81d46514bc2f57bd634a62525bedffc04f10cb4714c30253
font_02_sfnt_off00016060.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16060 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.