Malicious PDF — malware analysis report

Static analysis result for SHA-256 6960ddbd9b5c9622…

MALICIOUS

PDF

83.3 KB Created: 2021-03-25 12:41:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 9847169e16ad627d0b91faf499192027 SHA-1: 0989f49db7a43a83a72129e9cc4938565d4c95bf SHA-256: 6960ddbd9b5c96224dc8e360b1512a0dbd99dabe01814e5f97b581a7659ead14
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, mezovuduw.ru, which is likely used to host a phishing page or distribute further malware. The document body, though heavily obfuscated, suggests a lure related to tarot guides, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=celtic+cross+tarot+guide PDF link annotation
    • https://cdn.sqhk.co/vakanaju/XMighgT/piano_tiles_game_apk_free_download.pdfIn PDF document text
    • http://scrlt.xyz/12417757769e3pko.pdfIn PDF document text
    • https://cdn.sqhk.co/satijumok/Oly1idE/rekikabaruzumonugitikena.pdfIn PDF document text
    • http://xagowawusik.66ghz.com/tubuf.pdfIn PDF document text
    • https://cdn.sqhk.co/suxevevagova/hfiegjK/dedukulimopi.pdfIn PDF document text
    • http://rajuxotuxux.22web.org/25261471277.pdfIn PDF document text
    • https://cdn.sqhk.co/jututumogu/RgiajhE/rafokokuxewo.pdfIn PDF document text
    • http://heartcenteredequestrian.com/the_panopticon_read_theory_answers8m64p.pdfIn PDF document text
    • http://1freedom.space/unlimited_free_vpn_turbo_speed_vpnwfbkf.pdfIn PDF document text
    • https://cdn.sqhk.co/zetoreli/bVphPus/traffic_accident_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/tefazaturar/ic8MjjV/free_extreme_car_driving_simulator_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/001e3c81-776f-4a94-90da-ac32256f0f8f/kukoviposedibexe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e31e4517-57d3-4a21-9f73-38c5bd02ddf6/43179999030.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b75536f8-f8b0-4601-9380-3b513b723185/how_to_setup_mobile_hotspot_att.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/736f0550-bbb0-41d5-b5ac-5d133cabae85/kogofuzonexavubixoxotik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a81924fa-7174-4833-80f8-0cd367edd096/50970953676.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19c88c43-40a0-42cb-8ffc-39d42e071bbc/relation_and_function_class_11_solutions.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbf2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBF2 4904 bytes
SHA-256: 9bd9d543e27558b41cbd9f5a14e72d79693b2152be22fe7b46063fb735545bc5
font_01_sfnt_off00010cab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CAB 10544 bytes
SHA-256: d39526ed0bf3f11ab6b08badf3e0f982d128347c95277d1b2dd10b224a02d4b3
font_02_sfnt_off00013083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13083 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.