Malicious PDF — malware analysis report

Static analysis result for SHA-256 af72f42a4e3bc3f2…

MALICIOUS

PDF

80.0 KB Created: 2021-03-14 08:47:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 030e864bfeec0b0213d9a81186d4e329 SHA-1: c93a47a0c23768cde7a971184be8315aea66f303 SHA-256: af72f42a4e3bc3f201d6bf2e53d87beb013f276aa7e3b14f98ddb435df153ac3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains an embedded URI pointing to 'https://kuzutuzo.ru/strik?utm_term=maze+runner+character+thomas', which is likely a phishing or malware distribution site. The presence of PDF-specific heuristics and the overall structure suggest it's designed to exploit PDF viewers or trick users into visiting malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=maze+runner+character+thomas
    • http://vvinorama.website/world_war_1_movies_2020up2bf.pdf
    • http://romeita.space/marques_de_sade_descargar_librosr1834.pdf
    • https://static.s123-cdn-static.com/uploads/4420775/normal_5fe22e66eaf23.pdf
    • https://static.s123-cdn-static.com/uploads/4501214/normal_5fcf7dc4d19fd.pdf
    • https://cdn-cms.f-static.net/uploads/4393489/normal_6035ae4b9f5e3.pdf
    • http://galoomer.online/28003381418secv8.pdf
    • https://cdn-cms.f-static.net/uploads/4446931/normal_603001a6e28ba.pdf
    • https://static.s123-cdn-static.com/uploads/4413456/normal_5fee2b0e539a3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zunaporam/new_communicate_in_english_class_7_answers.pdf
    • http://tizafuj.epizy.com/infinix_note_8i_price_in_bangladesh_2021.pdf
    • http://poresiz.epizy.com/georgia_driver_license_manual_in_spanish.pdf
    • http://jikolelekad.epizy.com/chapter_12.2_meteorology_study_guide_answers.pdf
    • https://uploads.strikinglycdn.com/files/3a28e6f1-bba0-45c0-b54f-34278fac8a60/dopodivazogebokokiwaw.pdf
    • https://s3.amazonaws.com/nitidadufetenu/certificate_of_origin_form_d_philippines.pdf
    • http://jitoritobo.epizy.com/99841997949.pdf
    • https://s3.amazonaws.com/votawawo/39682768479.pdf
    • http://jadupapobixe.epizy.com/romivodokugosimid.pdf
    • https://uploads.strikinglycdn.com/files/eb32e31d-6b88-49ed-8572-49fc5d1125d6/rumixodegi.pdf
    • http://suremosanox.rf.gd/berliner_platz_1_cd.pdf
    • https://s3.amazonaws.com/bisapovepizaj/windows_7_microsoft_free.pdf
    • https://uploads.strikinglycdn.com/files/9fc7ac1a-078f-46e0-94d4-8e84002de368/legally_blonde_jr_tracks.pdf
    • https://uploads.strikinglycdn.com/files/fbfa48ba-c9af-4631-bd75-d5e75d5a0043/breville_ice_cream_maker_instructions.pdf
    • http://ralivapoked.epizy.com/lawuvibunomijifudodujidaf.pdf
    • http://puligop.epizy.com/sample_monthly_budget_excel_spreadsheet.pdf
    • https://s3.amazonaws.com/jupoti/44023931166.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc56.bin
8f0313505795e3305fba1d29ac3efe1519ae0d6c06f9ed1c4d67640283aa56b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC56 5060 bytes
font_01_sfnt_off00010d76.bin
f087124e58d7290377fa440f806d5f3fff5cb1bf44700cefd7d64a4b74c945e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D76 10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.