Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5a6ab68d3860e49…

MALICIOUS

PDF

83.4 KB Created: 2021-06-03 06:43:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 75804e176722ded76e87151195956d51 SHA-1: f94e3a28049903c02e19c5624047fa0d1f719c9f SHA-256: b5a6ab68d3860e49ae5bbd7605aadcef42a394c25fca0f105ff09ad819793508
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple detection engines, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains an embedded URI pointing to 'https://kuzutuzo.ru/123?utm_term=green+smoothie+revolution+pdf', which is likely part of a phishing or malware distribution scheme. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the external URI strongly suggests a malicious download or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/123?utm_term=green+smoothie+revolution+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4445749/normal_5ff0dd540743e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450040/normal_603690845da81.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449205/normal_5ff8fdb61412f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416125/normal_600322fd411be.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444104/normal_5fd1254f4c972.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460688/normal_601e49c8de4b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371790/normal_6029787a7e7fb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec62ca97-5a20-4a58-b6e0-3888f47e574f/92275891353.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a351b559-7306-4997-aa0f-cc6cf4c4875c/zobusijawe.pdfIn PDF document text
    • http://vazesuna.pbworks.com/f/58035648505.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56fb3f5d-55f6-41f9-a3da-eda6ddc7c35c/bovuto.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90809575-90a4-45fe-b54e-4da2871338a5/stephen_king_11_22_63_movie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2fe12817-34f5-403f-9b79-c6da3db5a736/33565391726.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/581859fb-7332-4674-a47f-c24c5c3d03fe/92926176810.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25772551-a5ca-4977-bf79-7e36329d8218/18227997420.pdfIn PDF document text
    • http://zubipuwaf.pbworks.com/f/dozazikatijaxaxola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42a451e8-ac6c-4e92-8669-d932a4d0b304/what_does_palsy_mean_in_medical_terms.pdfIn PDF document text
    • http://kedefoviraj.pbworks.com/w/file/fetch/144544221/66332093514.pdfIn PDF document text
    • http://bukafag.pbworks.com/w/file/fetch/144504219/wasasugeze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12552798-ba27-45b6-bbf5-27ebedcc1830/31886797470.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5fe9472-496d-4b38-96a9-d714c627bbfe/zavinunomesukitiserunegen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d46710a5-96e8-4adf-be84-dbb37dc0cac6/where_can_i_buy_sunbeam_heated_throw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/007c6f28-1cd5-4a8f-8388-98c9aefe7d7b/thermal_power_plant_commissioning_procedure.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC7D 5160 bytes
SHA-256: ca4928a7a4455aac27ae1eb71bb87846090f2c8f3957800bce704aa673ad4980
font_01_sfnt_off0000fdee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDEE 11180 bytes
SHA-256: 1737321e3bf7bd7410a46bf0da22d4cb99dba726e3025537c58fd6f1e08cb4ef
font_02_sfnt_off000123f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123F7 17612 bytes
SHA-256: 828f0f337d45f5d162a32ded1fb7fd017778611d05bb70b33339ae3cc11a8cb1

Open this report in the interactive analyzer, or submit your own file for analysis.