Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2bc8ec05a7c1501…

MALICIOUS

PDF

71.8 KB Created: 2021-03-23 04:30:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 313a0cfde2e72f3deac2b65b25f62294 SHA-1: 5922c8b8082bf94decbcf986f0dbe0d34db51c59 SHA-256: c2bc8ec05a7c15013e3c1b4012ff55b6ad82b58c2c740ac8cd863716e9546e96
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing or spam campaign, indicated by the presence of a large number of external links, many of which are to PDF files. The primary malicious URL identified is 'https://kuzutuzo.ru/wix?keyword=communicating+for+results+pdf+download', suggesting a lure to download content. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=communicating+for+results+pdf+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4482402/normal_5fcd340e1a154.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411944/normal_5fe31d0d2e9b7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376858/normal_5fe16897698bf.pdfIn PDF document text
    • https://repamepofasepa.weebly.com/uploads/1/3/1/4/131437198/tifafu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476427/normal_60527cddad5fa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425256/normal_5fefcaec9c429.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410462/normal_6020345c11700.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393647/normal_603692a6b2900.pdfIn PDF document text
    • https://rofinodaki.weebly.com/uploads/1/3/4/7/134721453/8d02028.pdfIn PDF document text
    • https://pupikitonusu.weebly.com/uploads/1/3/5/3/135301263/wekuden-rexek-tejebimeto-kogoruzaliz.pdfIn PDF document text
    • https://rimixobavi.weebly.com/uploads/1/3/3/9/133987070/8656890.pdfIn PDF document text
    • https://sofirutowik.weebly.com/uploads/1/3/1/3/131381411/xapufekukunotovin.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465007/normal_6006ffb8a32e6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447450/normal_5fe0c2c5c3284.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500446/normal_5ff8fcee7f1e8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://3c1efe6f-6e34-41bb-a2c4-2be85dd3cb33.filesusr.com/ugd/41f880_79c8fa2bd1a447639f455ffbd903099d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mejigavukolu/free_recipe_downloads.pdfIn PDF document text
    • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_6b36740db668426ea8c1a5523ae3c2ba.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rodiligarexo/45337185693.pdfIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/74941592561.pdfIn PDF document text
    • https://s3.amazonaws.com/vexeliku/impossible_quiz_answer_level_48.pdfIn PDF document text
    • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_81d1413541cb4d49a806012364645317.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/naxozelozude/xejose.pdfIn PDF document text
    • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_e802d4245a07402daeedc1cd05e84d58.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7E1 5472 bytes
SHA-256: 61ffc81e6129fc87a9ce0f69b7650f95f9dc650e4c32ca0ab55a3e91eb87be77
font_01_sfnt_off0000ea77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA77 11692 bytes
SHA-256: 6a1ff52591a65d94f632660e374cb0b72e6b4ecb95a8209fca8754d943ac37f0

Open this report in the interactive analyzer, or submit your own file for analysis.