Malicious PDF — malware analysis report

Static analysis result for SHA-256 96bc913eeac4dcb3…

MALICIOUS

PDF

75.2 KB Created: 2021-04-04 03:06:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: bbe411d4fbf1ffc901b76f1f5ea98491 SHA-1: 0a89aeff8bc0f850f4c660e3c00c7fdc1d343375 SHA-256: 96bc913eeac4dcb39f9e6a523d9a0b6c5c020ecb6cf52fa8c9da792e6c6cd636
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm, with numerous embedded URLs pointing to potentially malicious domains, including 'kuzutuzo.ru'. The presence of PDF_SEO_DISPOSABLE_LINK_FARM suggests an attempt to obscure the true malicious intent through a large number of links on disposable hosting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=vizio+e600i-b3+price PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481065/normal_6056cb77167a7.pdfIn PDF document text
    • https://cdn.sqhk.co/xesozugis/jf6UYuh/82442207715.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459641/normal_5fd3283a94035.pdfIn PDF document text
    • https://cdn.sqhk.co/zapiseniw/jixghG4/diburewexujilijabede.pdfIn PDF document text
    • https://cdn.sqhk.co/rorefevobo/hcgeKqw/61674761048.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412593/normal_6004512e5d479.pdfIn PDF document text
    • http://roflan.site/jesosubrjbn.pdfIn PDF document text
    • http://poopo.ru/michael_swan__catherine_walter_oxford_english_grammar_course_advanced_oupcdoxv.pdfIn PDF document text
    • https://fosovumukudire.weebly.com/uploads/1/3/4/2/134235423/nifixogowur.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376606/normal_602fdee992ae6.pdfIn PDF document text
    • https://dekedenavit.weebly.com/uploads/1/3/4/6/134612093/bagare.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484835/normal_5fefc616a4b5f.pdfIn PDF document text
    • https://zavitakeji.weebly.com/uploads/1/3/4/9/134904790/nupewotupuw.pdfIn PDF document text
    • http://chestlune.online/joining_up_listening_answers_test_5w3rk5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://b20aee1f-b1b7-4e4e-be5e-d884e4ece670.filesusr.com/ugd/10e3af_e88d940c67f640f09827fa07f2c6618f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tupofelasujewas/ford_3.0_v6_weight.pdfIn PDF document text
    • https://083189c9-8220-4687-a375-57be19a37228.filesusr.com/ugd/909b15_4f9104a63eac4b1e99ef11eaceefaaad.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sasufufa/93965212753.pdfIn PDF document text
    • https://23fe9111-5aa3-4288-b7a4-a84c242bb647.filesusr.com/ugd/d35b85_7bb4d92824914ba19400dba5856b20a6.pdf?index=trueIn PDF document text
    • https://168d2a81-f750-40c6-a653-3787650f980d.filesusr.com/ugd/3bcfef_ba6f3f95aa9247efad5311ad44bcaf99.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e866.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE866 5152 bytes
SHA-256: 69b0acd56a6160291e823fd86839d8e78410530eb14d523fe2b95f8736a76892
font_01_sfnt_off0000fa0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA0E 11292 bytes
SHA-256: 0e7b5ac877f63b1b25c4540e2fd7a1c215aecc42430aaef869c2440f2fc503e9

Open this report in the interactive analyzer, or submit your own file for analysis.