Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b7eaa091be962d0…

MALICIOUS

PDF

92.9 KB Created: 2021-03-30 04:59:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92dcae48d9bb07fbbef25265a347a400 SHA-1: 255fece7f89f2d2078ba8b03efa63b0dd59e752e SHA-256: 9b7eaa091be962d08fbfd50c9718fe17652a2907973fa604ddca113206fb99f6
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan-like behavior. The presence of an embedded URL pointing to 'mezovuduw.ru' suggests an attempt to redirect the user to a malicious download site. The heuristic 'SE_DOWNLOAD_BUTTON' further supports the phishing lure aspect.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9831

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=dissidia+opera+omnia+english+apk+%252B+obb+download
    • https://cdn.sqhk.co/bodorosuzuta/jj6hiig/10039718957.pdf
    • https://cdn.sqhk.co/jiwosowo/kzjgJjf/minecraft_among_us_map_skeld.pdf
    • https://static.s123-cdn-static.com/uploads/4500889/normal_5fc7c4c53f18c.pdf
    • https://cdn-cms.f-static.net/uploads/4485162/normal_604cf2469759c.pdf
    • http://leworowotamab.iblogger.org/bumasugenizibevo.pdf
    • https://cdn.sqhk.co/bifoligi/hdigjij/ravens_covid_reserve_list.pdf
    • https://static.s123-cdn-static.com/uploads/4443344/normal_60036f2d4fc5e.pdf
    • https://cdn.sqhk.co/jasowipe/hfjiZFQ/43904257166.pdf
    • https://cdn.sqhk.co/letarezetap/qCFbfIF/free_funeral_program_brochure_psd_template.pdf
    • https://static.s123-cdn-static.com/uploads/4410694/normal_5fc86f5724344.pdf
    • https://cdn-cms.f-static.net/uploads/4451376/normal_60263c83ca4bf.pdf
    • http://vukuwupevipe.iblogger.org/60858907231.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/1fea204d-4719-41af-97af-91812de7d84a/after_the_fact_the_art_of_historical_detection_chapter_12_summary.pdf
    • https://147762ec-90f0-4523-8579-43cb3cd17c82.filesusr.com/ugd/6c48b9_de2424571e0b4d71bcbb02896f8d28ae.pdf?index=true
    • http://rubuvajaroxe.epizy.com/luwoge.pdf
    • https://uploads.strikinglycdn.com/files/3b748398-096d-4bed-902f-28fcfb92b03f/fikewaxesubalalibiroxelib.pdf
    • https://uploads.strikinglycdn.com/files/a663ca51-2a74-493e-8295-39a7d46a282e/maytag_washing_machine_error_code_e01.pdf
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_8263c0df6e4d47359a88564635b03748.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4675b002-fb3a-4291-b8a7-9bcddbde2608/how_to_charge_a_milwaukee_m12_battery.pdf
    • https://s3.amazonaws.com/kijelopazekune/metformin_side_effects_fatty_liver.pdf
    • https://beea745c-e446-4317-9ad8-fe501d584c0a.filesusr.com/ugd/9196db_4b0d6bcc60a5430b86715fcc4bd92b60.pdf?index=true
    • http://bipufapo.rf.gd/flowers_in_the_attic_2014_streaming.pdf
    • https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_a8b4f7bea0b0411ea25e91e99b82d78d.pdf?index=true
    • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_6972a0f011c24828a3ab42f86a66ff4d.pdf?index=true
    • http://zamonile.epizy.com/angielski_w_tumaczeniach_gramatyka_5_chomikuj.pdf
    • https://s3.amazonaws.com/telasebisu/how_to_set_an_electric_plug_timer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f99f.bin
f7fc9efa419d418649abc04b1de492acea312fb92ba3447f123e73155e0b3f97		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF99F 3640 bytes
font_01_sfnt_off00010695.bin
6c9e72c52bdee73383b70518edf2422f7014f272919fa06b59ab02ee56e19d1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10695 5376 bytes
font_02_sfnt_off000118b0.bin
a17fcbf69835227ca2f97169b9b1a94cca0bbfb65d4924f86f425c272cf20c0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118B0 11060 bytes
font_03_sfnt_off00013e80.bin
87cf1c39eeb5c062296010f864d0fa7085e73dfcd6787411685ffd8902901794		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E80 16284 bytes
font_04_sfnt_off0001540a.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1540A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.