Malicious PDF — malware analysis report

Static analysis result for SHA-256 c729cb3ff93a3169…

MALICIOUS

PDF

77.1 KB Created: 2021-04-13 09:44:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 3a63a93d32ffa0d4f86e15e756244eb3 SHA-1: 275ff96adc7a42dc9cd4b102c60580ca84bc1bd8 SHA-256: c729cb3ff93a3169e40622eb9aafb9ec4dbfe450823b53c650e43a228a40d423
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high probability of malicious intent. The embedded URL `https://mezovuduw.ru/strik?utm_term=types+of+interior+design+styles+quiz` suggests a phishing or credential harvesting attempt, disguised as a quiz. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=types+of+interior+design+styles+quiz PDF link annotation
    • https://cdn.sqhk.co/raxuzuvuluf/KYtjjhj/guide_2020_among_us_tasks.pdfIn PDF document text
    • http://jefuvumerusew.getenjoyment.net/response._contenttype_application_vnd._ms_excel.pdfIn PDF document text
    • https://cdn.sqhk.co/wikelere/Cjjq6jc/2582881603.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487641/normal_6043f3fad9cf8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366004/normal_5fc96ec80776d.pdfIn PDF document text
    • http://fidofawi.medianewsonline.com/12335727355.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445864/normal_60048eace38a6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366659/normal_60184c1f46ae1.pdfIn PDF document text
    • https://cdn.sqhk.co/kajipazuto/EgfD9ig/rope_swing_trex_railing.pdfIn PDF document text
    • http://wufamega.scienceontheweb.net/gnss_adalah.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/remavuj/31692555589.pdfIn PDF document text
    • https://s3.amazonaws.com/piwupevivotixi/el_chac_mool_cuento.pdfIn PDF document text
    • http://xutenujute.myartsonline.com/93006215773.pdfIn PDF document text
    • https://s3.amazonaws.com/xixonu/chilled_water_pipe_sizing_software_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/913e9122-a1c7-4ab6-a250-7b02cd9cf90c/connect_directv_genie_mini_to_internet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfc16afa-28f0-4b71-9373-8b5c303d993a/what_is_formed_when_two_or_more_atoms_join_together_chemically.pdfIn PDF document text
    • https://s3.amazonaws.com/xunilukegez/bakelite_sheet_density.pdfIn PDF document text
    • http://kavezusi.onlinewebshop.net/coulomb_law_example_problems_with_solutions.pdfIn PDF document text
    • http://marurutefa.atwebpages.com/36493012657.pdfIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/dowazinofax.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f12d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF12D 5228 bytes
SHA-256: 7aad24ba703cbcde9bf8668f98f6f61f96199434428648aaa9ef7eaa3bdff583
font_01_sfnt_off00010312.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10312 10672 bytes
SHA-256: 203fa2a5b4d3eebc923b79c2ce9c03979075c894844a2ed339874622f90c30ea

Open this report in the interactive analyzer, or submit your own file for analysis.