Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b528943caa23099…

MALICIOUS

PDF

74.9 KB Created: 2021-03-18 06:01:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0b94c8f9fb9e261b502437a5c1083c8d SHA-1: 821484ef31d5e7d140b80832f0a7fd7b79870ab8 SHA-256: 7b528943caa23099252d1398cd1e51bc2ddff38d654903df906788b4d5bcd898
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with several pointing to suspicious domains like 'kuzutuzo.ru' and 'swiss-gear.store', suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, appears to be a lure related to survival kits, which is a common tactic for phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=wilderness+survival+kit+contents+list
    • http://swiss-gear.store/how_many_stamps_for_domestic_mail_canadacezfk.pdf
    • http://vogolimipogusoz.mypressonline.com/xuzoseriduzeturej.pdf
    • http://biniwitovo.mywebcommunity.org/how_much_is_toyota_sienna_in_nigeria.pdf
    • https://static.s123-cdn-static.com/uploads/4449000/normal_5fe43a582178e.pdf
    • https://cdn-cms.f-static.net/uploads/4411218/normal_601eb8b5a42fe.pdf
    • https://cdn-cms.f-static.net/uploads/4475859/normal_601a0f2b5a657.pdf
    • https://static.s123-cdn-static.com/uploads/4414489/normal_60078e2be9b5b.pdf
    • http://doweryklkq.space/tiniruxikefebzylhk.pdf
    • http://shopyou.online/what_does_navajo_dine_meanv3e2g.pdf
    • https://static.s123-cdn-static.com/uploads/4456982/normal_5fe4c6a3582df.pdf
    • http://claire-irk.ru/cthulhu_britannicakiu1g.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://61df3396-90b5-4b69-a3ae-475c9da6ebc5.filesusr.com/ugd/516574_cc78e2981ad44f028b59967184805d95.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5041aa59-988e-431c-9ff2-38814db9467a/how_to_use_the_learn_button_on_a_liftmaster_garage_door_opener.pdf
    • https://uploads.strikinglycdn.com/files/098f81db-55af-46b7-a744-2e3d7214a622/list_of_conjunctions_in_english_and_spanish.pdf
    • https://2178e3ec-2e0a-46e0-af35-d8a6fdfeb21a.filesusr.com/ugd/c411cf_b0f7315e6f2c44c8a4a6655fad40d0db.pdf?index=true
    • https://0e818273-c791-4c7a-b20f-750474b78fe4.filesusr.com/ugd/362633_fbf0f75c806d47448bedba714f84a7a4.pdf?index=true
    • https://9170d309-caca-4186-8987-bf6b40ce219c.filesusr.com/ugd/baef12_d7a4d766385a4a2f982e9c5d12cd0987.pdf?index=true
    • https://e055bcc9-c4f1-4c6c-8dcb-0912bf54750f.filesusr.com/ugd/b4a829_35417a7cb6a0458d8b991db6484578f9.pdf?index=true
    • http://vawofirulev.myartsonline.com/metabolismo_humano.pdf
    • https://uploads.strikinglycdn.com/files/57d002c4-9a00-45d5-8b83-faac0ba6a176/how_to_distinguish_between_bacterial_and_viral_bronchitis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e721.bin
c378fab18204a714115e6d45f2505b5be0a4fc1de3645fb0274178ba6c817289		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE721 5072 bytes
font_01_sfnt_off0000f880.bin
e13504bbe48afc3895729c4171db6d6d2f2e50f5270a3bae7902d94e7d91c520		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF880 10596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.