Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd59be9114e29fe3…

MALICIOUS

PDF

76.2 KB Created: 2021-05-08 12:01:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ddac63330fc4a2165d78aef588f59aea SHA-1: eeed73850833b71f7188b3b5a19b988be987af45 SHA-256: cd59be9114e29fe38f44e14f018ac18c33c41dba084da6f8a9a3da4c6056c154
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting a link farm or redirection mechanism. The primary malicious URL, https://kuzutuzo.ru/strik, is likely used to host phishing content or distribute further malware. No scripts were extracted, but the PDF structure and numerous external links point towards a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=new+moon+capricorn+2021+astrology
    • https://cdn-cms.f-static.net/uploads/4403556/normal_600e292d5b2d4.pdf
    • https://pitulero.weebly.com/uploads/1/3/2/6/132683003/a9e161.pdf
    • https://nefabilaj.weebly.com/uploads/1/3/1/4/131438225/rezevuxewijinu.pdf
    • https://cdn-cms.f-static.net/uploads/4457279/normal_5fd8cd002c5d0.pdf
    • https://fozogefijegajor.weebly.com/uploads/1/3/1/4/131453134/jadabuf.pdf
    • https://davabodijesofid.weebly.com/uploads/1/3/4/4/134474123/jizudonirafew.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bd6721b0-70a3-4113-912e-93191898de8a/dbx_share_price_forecast.pdf
    • https://f7e05ffc-afae-4d19-be15-7e9c659e5e5f.filesusr.com/ugd/72f62b_c58e35c90acc4f31b80afa327459933c.pdf?index=true
    • https://6843e3eb-5573-46e1-90a0-370cfc2b4a0d.filesusr.com/ugd/89b1bc_0a493ab59a6941c0adfefd08e058eb8a.pdf?index=true
    • https://s3.amazonaws.com/liwafo/world_war_z_ps4_multiplayer_review.pdf
    • https://s3.amazonaws.com/remavuj/daxutenivinipa.pdf
    • https://bf808793-8b46-4c54-8b11-319763181fa0.filesusr.com/ugd/0d018b_03363d287f554f5faf1297f9c561a531.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5b2ac0e3-41aa-48f3-89f4-4cdd387d2746/elementary_particle_physics_textbook.pdf
    • https://s3.amazonaws.com/davubewu/probability_dice_calculator_answers.pdf
    • https://uploads.strikinglycdn.com/files/537fe860-f403-40c0-8679-7fd03324c416/98139609113.pdf
    • https://4c8e72c6-e2e3-4108-adc6-102de481692d.filesusr.com/ugd/f4b4ca_aaa8a9e639314f8db902994dce50dad2.pdf?index=true
    • https://s3.amazonaws.com/povodijirig/39967460616.pdf
    • https://s3.amazonaws.com/kesumasaka/gapisozelisipigu.pdf
    • https://9539e3d7-93ad-434a-85ac-22bd9bdb82bb.filesusr.com/ugd/df7b34_4233d8da20ae467a90875a871059c66e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/570ba30a-eabd-4ba2-89cd-7f17f59e7fac/sitozidowev.pdf
    • https://uploads.strikinglycdn.com/files/03db1cac-ca9c-4954-99d3-21ddba45f97b/diff_between_promissory_note_and_bill_of_exchange.pdf
    • https://s3.amazonaws.com/zuguvoxoki/fuwibu.pdf
    • https://s3.amazonaws.com/viromibukoleliw/how_to_clean_whirlpool_top_load_washing_machine.pdf
    • https://s3.amazonaws.com/forupokisip/93880587320.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea99.bin
f9f1533a7767001bba2f2aeb5ec3d6e112afdb7a77442aae820740e94ccb1f47		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA99 5740 bytes
font_01_sfnt_off0000fe2e.bin
5a83ecfacdd6b887bd6a31cb015670545762c4e1ee05f7f4de101984ecc3a97f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE2E 10924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.