Malicious PDF — malware analysis report

Static analysis result for SHA-256 af78ada87fb6c758…

MALICIOUS

PDF

78.5 KB Created: 2021-03-16 00:31:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7779e88e5509d4f7376b2162eeddf8a3 SHA-1: 7b4c35b72d9f3745643893c81906e02e3f77fc8b SHA-256: af78ada87fb6c758b6bd001bc1cdf3d3646017db0654b20a0f994913b87d5ab2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://kuzutuzo.ru/strik?utm_term=dark+romantic+authors', which is likely used to deliver a secondary payload or redirect the user to a phishing site. The document body is heavily obfuscated, suggesting an attempt to hide its true purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=dark+romantic+authors
    • http://soldatskaya6.ru/lords_of_chaos_murders9jldx.pdf
    • https://cdn.sqhk.co/nasubivapu/Wujciif/wotukibigadajanelor.pdf
    • https://cdn.sqhk.co/wodabakope/qhibnia/original_3d_crystal_puzzle_skull_step_by_step.pdf
    • https://cdn.sqhk.co/fabozesemi/hbAYT7Y/cops_n_robbers_mini_game.pdf
    • http://kufagexuwinu.22web.org/dixebirarowepugaxe.pdf
    • http://vabademajelid.iblogger.org/tufom.pdf
    • http://universityru.fun/animal_coloring_pages_to_print_for_freeitu0f.pdf
    • http://wisitens.online/gerudo_valley_sheet_music_flutegtoop.pdf
    • http://vannabanyavsedela.xyz/how_many_degrees_of_separationtqy8f.pdf
    • https://cdn.sqhk.co/tuseliwi/jhcjghg/saxexegizovelir.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nikavavufuxirel.epizy.com/bersa_thunder_380_specs.pdf
    • https://uploads.strikinglycdn.com/files/43038e69-99fa-44ad-8924-5c642aa1e247/gupemiduvowinon.pdf
    • https://uploads.strikinglycdn.com/files/c11c8451-1995-4e2d-b59b-ed441a68bd6a/learn_hangul_online_game.pdf
    • http://dusetelonuzaj.epizy.com/wolf_run_casino_game_free.pdf
    • https://uploads.strikinglycdn.com/files/c12d799b-89c5-487f-ac43-770b4cbeabef/the_cast_of_coming_to_america_two.pdf
    • https://uploads.strikinglycdn.com/files/81d7b8e6-7404-4b6c-a270-d242aa343812/good_soccer_drills_for_5_year_olds.pdf
    • http://jadaxanesutav.epizy.com/whats_in_a_caramel_iced_coffee_from_dunkin_donuts.pdf
    • https://uploads.strikinglycdn.com/files/cd08481e-901f-404f-95b8-1e94cc12415a/month_to_month_lease_bad_credit.pdf
    • https://uploads.strikinglycdn.com/files/6479ebb2-3ad2-4459-b545-1ac044730098/the_standard_price_of_materials_is_3.50.pdf
    • https://uploads.strikinglycdn.com/files/2278e839-af45-429d-a6e3-259647acb5eb/hp_officejet_4500_print_cartridge_problem_tri-color.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3c6.bin
295ab7f633f416e49806e7f99be47c6a926c386ab0cd06d899f0933185149171		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3C6 5068 bytes
font_01_sfnt_off000104e5.bin
69b2c756661caa6777812a36a3ca75f5efd1516069ff883d0b7f37d4c270d750		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104E5 11480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.