Malicious PDF — malware analysis report

Static analysis result for SHA-256 828661c97e7da39a…

MALICIOUS

PDF

79.4 KB Created: 2021-03-22 10:31:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 428f96d2b907a5d58c7c50b110b26837 SHA-1: 70d6b1f1f4eacd7edf7f27e7f9229a299c308cbb SHA-256: 828661c97e7da39af8fa63011a63152758ef695ce561d87479ad5e8ad79e04ac
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, mezovuduw.ru, which is likely used to host phishing content or a secondary payload. The document body, though partially corrupted, suggests a lure related to skincare, which is a common tactic for phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=como+n%25C3%25A3o+ter+mais+cravos
    • http://tomandbxof.site/tupotapagudofakuvesaruguc27m4.pdf
    • https://cdn.sqhk.co/xisalaximel/hjw54ih/33870507850.pdf
    • http://xosubowavenu.mypressonline.com/america_s_test_kitchen_family_cookbook.pdf
    • http://xteenware.online/how_to_turn_off_wally_receiveromwv2.pdf
    • https://cdn.sqhk.co/selodiro/cSXofsf/free_printable_simple_business_plan_template.pdf
    • http://okclub.org/xokazepefivh1kcg.pdf
    • https://cdn.sqhk.co/genamudazunu/dyVgf2J/zabekoxuzafebesufu.pdf
    • http://navaram.online/whimsy_arcade_jcube_opening_hoursj3xn8.pdf
    • https://static.s123-cdn-static.com/uploads/4367916/normal_5fc70fc06dec9.pdf
    • https://cdn.sqhk.co/bodorosuzuta/gcFagha/synonym_disorderly_conduct.pdf
    • http://xivobivivupe.mygamesonline.org/anti_cancer_journal.pdf
    • http://nukicew.xyz/eureka_boss_smart_vac_4870_parts6w50h.pdf
    • https://cdn-cms.f-static.net/uploads/4487641/normal_5fdc0fc57458d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3f5765b5-411c-4b28-96d1-a1e3b219bcee.filesusr.com/ugd/ca847e_c3f7e06af0344cef988dc149013c60a6.pdf?index=true
    • https://6baea7ca-81e4-4a11-8410-716433a99462.filesusr.com/ugd/764aaa_ff641c56800f43c6b8a0c2ee15ac7a58.pdf?index=true
    • http://bifovigavij.myartsonline.com/dark_heresy_ascension_fr.pdf
    • https://uploads.strikinglycdn.com/files/edcd2311-0533-4888-9de4-58cb3ac20768/dear_man_give_fast_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/a7dc2825-21b8-4b77-bf88-d164abf191d7/pedilat.pdf
    • http://bidusibebawuz.onlinewebshop.net/rajikasimamode.pdf
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_8819ff2ac86142f39a20d7aac9cb9a0a.pdf?index=true
    • http://zejusamipokera.myartsonline.com/87725142221.pdf
    • https://ae40ec61-d20a-40a8-9c94-208d4569f534.filesusr.com/ugd/5d0862_4f43198d2a0442ec871c816cf8d04e55.pdf?index=true
    • https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_7539c7ef853042399fa7937f227a81fd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3f0c6f1d-f386-436a-8baa-f4c9cac1a780/95891485703.pdf
    • https://uploads.strikinglycdn.com/files/845c046b-28e8-42bc-88a3-99036f9ad7ff/what_to_read_after_i_survived_series.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f656.bin
4e2a5d3a270f065b70454faa11d4bf43a81e1e7ddc79529f8925e0f738057bb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF656 5196 bytes
font_01_sfnt_off00010752.bin
451a4ce1893a9563287b6590e3454045f83045560fa58213a792c766cfc076bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10752 12548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.