Malicious PDF — malware analysis report

Static analysis result for SHA-256 7459f8aa23fd3346…

MALICIOUS

PDF

74.5 KB Created: 2021-05-04 06:42:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: ce9a057e6999ab10f0728762f618e71e SHA-1: 49d938b580495927d7269575631e63dc11f44064 SHA-256: 7459f8aa23fd33469cc0600a959b5fedc323863e56836e7269f73517c89203d8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external URIs, with at least one pointing to a suspicious domain ('kuzutuzo.ru') that is likely used to host malicious content or redirect to phishing pages. The document body, though heavily obfuscated, suggests a lure related to relationship advice, a common tactic for social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=cuanto+tiempo+tarda+un+hombre+en+superar+una+ruptura PDF link annotation
    • http://apple-fruit.space/25101358371xlbai.pdfIn PDF document text
    • https://wozovogunetip.weebly.com/uploads/1/3/5/3/135396590/3204170.pdfIn PDF document text
    • http://geekcods.com/english_vocabulary_exercises_pre-intermediatesgmhn.pdfIn PDF document text
    • http://olymp-trade.top/the_anatomy_of_story41f5h.pdfIn PDF document text
    • http://ruvinowuge.scienceontheweb.net/canciones_en_guitarra_acustica_romanticas.pdfIn PDF document text
    • https://tufelonidozuwux.weebly.com/uploads/1/3/2/6/132681512/wejorexixis_fuxer_xegod_xigopejov.pdfIn PDF document text
    • http://raifaisentgo.online/pre_calculus_grade_11_textbookgmfg7.pdfIn PDF document text
    • http://manovina.mypressonline.com/senesivukesomeroxi.pdfIn PDF document text
    • https://fisikovomit.weebly.com/uploads/1/3/4/6/134652659/75e238df0.pdfIn PDF document text
    • http://vemasujananexu.22web.org/android_studio_adb_not_starting.pdfIn PDF document text
    • http://gepozuj.iblogger.org/what_are_some_good_persuasive_essay_topics.pdfIn PDF document text
    • http://dotasif.iblogger.org/16336095090.pdfIn PDF document text
    • http://bijukexamova.scienceontheweb.net/journal_el_khabar_22_avril_2020.pdfIn PDF document text
    • http://devedilazabu.medianewsonline.com/dajorefuxovigopegon.pdfIn PDF document text
    • http://workshop-fb.ru/mortal_kombat_trilogy_androidt4scz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/45bd4542-42e2-4ef6-b19d-bcabf45da324/self_determination_theory_of_motivation.pdfIn PDF document text
    • http://daloketo.epizy.com/gaxezesetewemugiza.pdfIn PDF document text
    • https://651f5d5e-5f42-4fb0-8380-889764ca350f.filesusr.com/ugd/b2f7c1_101af4d80f0f4a148047d6e3b9843064.pdf?index=trueIn PDF document text
    • http://kaxogesidod.epizy.com/rajaza.pdfIn PDF document text
    • https://7ae774ad-b64d-4473-a0b1-aa0db1e39e83.filesusr.com/ugd/3e7897_2b4bdd84f5ab4ffd8c280756cec28a39.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d0ed9b1-5222-43f9-9e3a-60922923e1c7/ropefotolitevifap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d4d4861-6a53-463b-970b-6760dd5eb662/lowrance_hook_5_hdi_price.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3EB 5212 bytes
SHA-256: bbba0c8fc179ae6dc8a65565ff2649ae90b48c89257210b53a70d133ee3e9529
font_01_sfnt_off0000f566.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF566 11368 bytes
SHA-256: df8205cd41049e6a72aa904c0d02441ffea5295f2d4678b989827c79c2b4ffc2

Open this report in the interactive analyzer, or submit your own file for analysis.