Malicious PDF — malware analysis report

Static analysis result for SHA-256 b95ca28a39206bda…

MALICIOUS

PDF

80.8 KB Created: 2021-03-19 23:32:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: cfb284170f2ba1443c0dcf8c43bb586c SHA-1: 70fcf407e696bcf5f83bafcd1840f0e1ab5c7e5d SHA-256: b95ca28a39206bdaffc1f28629ec103ad53417bcf75152da11865a7f788a861a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document contains an embedded URI pointing to 'kuzutuzo.ru', which is likely part of a phishing lure impersonating Google Docs. Several other unknown URLs were extracted, suggesting a broader campaign. No scripts were extracted, but the PDF structure itself facilitated the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=google+docs+frozen+movie PDF link annotation
    • http://misudijawalezom.22web.org/kavupepavininerurozufup.pdfIn PDF document text
    • http://juvasojiwal.66ghz.com/60453838414.pdfIn PDF document text
    • http://getcabinets.xyz/norton_anthology_of_drama_3rd_edition_ebook3gqc7.pdfIn PDF document text
    • http://oneitstore.info/how_do_you_think_preschoolers_learn_bestk3k6a.pdfIn PDF document text
    • http://basukoroj.22web.org/82548881972.pdfIn PDF document text
    • http://edayafar.xyz/country_bump_line_dance_stepsheeti0g2f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lemerobumagojox.epizy.com/stop_think_breathe_app_android.pdfIn PDF document text
    • https://s3.amazonaws.com/megujobemegor/devourer_arahakan_hell_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/kugelilizibuwum/best_shuffle_dance_music_2020_mp3_download.pdfIn PDF document text
    • https://s3.amazonaws.com/dorobukasawituw/68482869897.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b70ce50b-dd99-4056-babb-431059bd46d2/how_to_open_samsung_air_conditioner_remote_control.pdfIn PDF document text
    • https://s3.amazonaws.com/vovopafubipu/painting_wood_cabinets_black.pdfIn PDF document text
    • http://defasawune.epizy.com/lsat_preptest_70_answers_and_explanations.pdfIn PDF document text
    • http://puwokamavureme.rf.gd/dovey_magnum_bawl_out_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90bd8170-a908-40a9-bd39-b22f416c206f/software_architecture_diagram_app.pdfIn PDF document text
    • https://s3.amazonaws.com/kovozenamofox/arcon_normal_font_free.pdfIn PDF document text
    • http://puxitisajit.epizy.com/wedawilujijuderu.pdfIn PDF document text
    • http://xarugutivi.epizy.com/customs_clearance_procedures.pdfIn PDF document text
    • http://jirizaxewusi.epizy.com/38884672634.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91987b99-ca3c-4cce-a7ac-31ece5853a26/taco_bell_power_bowl_nutrition_no_rice_no_beans.pdfIn PDF document text
    • https://s3.amazonaws.com/zopenave/bosch_silence_plus_44_dba_factory_reset.pdfIn PDF document text
    • https://s3.amazonaws.com/pirosisob/nptel_probability_and_random_processes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9FE 5272 bytes
SHA-256: 95db0c99b9121428460301477deef7c9259b30fec85904b91d4b508495876ede
font_01_sfnt_off0000fbf3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBF3 10488 bytes
SHA-256: 82a27e55f76c1949a1c363d80b9ae93bba938276f20f3a71a13d9b303c837141
font_02_sfnt_off00012025.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12025 16388 bytes
SHA-256: 0c82561ead172ac0e51412abe629b5944d5f81f469066018c017fef234fe4ba7

Open this report in the interactive analyzer, or submit your own file for analysis.