Malicious PDF — malware analysis report

Static analysis result for SHA-256 9256af1d636e17f5…

MALICIOUS

PDF

77.0 KB Created: 2021-03-17 04:07:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 486089c3d79da0619e971881309326f4 SHA-1: ea1ae53204c3087ba41d3d29e66a4d8619f14c22 SHA-256: 9256af1d636e17f57fbf020bb249d20bc66877da6038b6bc59da0f36c96c4f93
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'kuzutuzo.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains keywords related to a 'Rheem tankless water heater cleaning kit', suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=rheem+tankless+water+heater+cleaning+kit
    • http://sopugepibimel.mypressonline.com/topazozixexet.pdf
    • http://fujigukatujewu.medianewsonline.com/passione_canzone_napoletana.pdf
    • http://itdiscount.pro/how_does_color_affect_heat_absorption_hypothesisjrxzh.pdf
    • http://kuzexamipapoxip.medianewsonline.com/for_the_first_time_piano_sheet_music.pdf
    • http://lejidakoxinetog.mywebcommunity.org/wojonuxepepiros.pdf
    • http://bigops.fun/2284989709670iaw.pdf
    • http://risonubokedoxav.scienceontheweb.net/adverb_worksheets_grade_6.pdf
    • http://lamaded.mywebcommunity.org/2003_honda_rancher_350_performance_parts.pdf
    • http://mamajan.space/factorising_harder_quadratics_maths_genie_answersiswti.pdf
    • http://load-bcp.com/balu_mahi_full_movie_hd_720p1supq.pdf
    • http://vuvulusigi.scienceontheweb.net/counseling_skills_for_speech_language_pathologists_and_audiologists_2nd_edition.pdf
    • http://ketaton.mywebcommunity.org/como_desapegarse_sin_anestesia_walter_riso.pdf
    • http://lorakuze.sportsontheweb.net/ma_rmv_permit_test_locations.pdf
    • http://mudikovarew.mygamesonline.org/tafafakim.pdf
    • http://goossyy.online/434298439069zosi.pdf
    • http://bomepufibawil.scienceontheweb.net/affirmative_model_of_disability.pdf
    • http://pinerapidsrr.com/beethoven_ukulele_moonlight_sonata0hclj.pdf
    • http://kopalirigel.mypressonline.com/bimumobirunetomuveka.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://todifisafi.atwebpages.com/english_alphabet_for_children_printable.pdf
    • http://gifidabula.atwebpages.com/printable_letter_tracing_worksheets.pdf
    • http://jemileti.atwebpages.com/xekapemiworavafow.pdf
    • http://noroved.myartsonline.com/how_to_create_a_blog_for_free_on_google.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eee2.bin
b8278facb7c438fc06642634e9f82f7f8918ac1d363ec117b152b1fad66c3756		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEE2 5376 bytes
font_01_sfnt_off0001010f.bin
2408762d65eec0e33fe29109b6d6743ed2a4b9ed0cf37aaf6b4b038ef5442260		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1010F 11028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.