Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf8bfabf788960ca…

MALICIOUS

PDF

83.5 KB Created: 2021-03-29 19:16:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 15552345a29dcb4f92bbb90ec4e171ae SHA-1: 9f8ca0baa1d529d192c3d2370b26f760cc6dd47d SHA-256: cf8bfabf788960cab30fc5eb51554e203b3d3a15564f9be2224cec8631f15cbb
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'mezovuduw.ru' suggests the document is part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=blood+relation+pdf+ibps+guide
    • https://cdn.sqhk.co/senuziker/hJjzxic/zusaxiwusefokiketopana.pdf
    • https://cdn-cms.f-static.net/uploads/4478961/normal_60339164de86c.pdf
    • https://static.s123-cdn-static.com/uploads/4407994/normal_5ff003d84c573.pdf
    • https://static.s123-cdn-static.com/uploads/4387813/normal_5ff87d9966b4d.pdf
    • https://static.s123-cdn-static.com/uploads/4368767/normal_5fe1ee560f11e.pdf
    • https://cdn-cms.f-static.net/uploads/4415081/normal_601ba5558c10a.pdf
    • https://cdn.sqhk.co/labojime/Tgehj9y/67376884732.pdf
    • http://xomunuxeju.sportsontheweb.net/mutajutadajalar.pdf
    • https://cdn-cms.f-static.net/uploads/4446260/normal_600a9da29421c.pdf
    • https://cdn.sqhk.co/togixulala/ahjfihN/annamayya_songs_free_teluguwap._net.pdf
    • https://cdn.sqhk.co/libegavezu/fHgjjhs/75196077922.pdf
    • http://narovomesizi.medianewsonline.com/what_is_a_close_textual_analysis.pdf
    • https://static.s123-cdn-static.com/uploads/4422136/normal_5fcedf6372fb6.pdf
    • https://cdn-cms.f-static.net/uploads/4481156/normal_6043985ce92dd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gixejemazob.myartsonline.com/86940040758.pdf
    • https://s3.amazonaws.com/gotijejaj/44754088281.pdf
    • https://b998fa74-583e-446a-a2a7-67f41460fdb2.filesusr.com/ugd/e081f8_071e16be1eb041fbb7530acf8e54d148.pdf?index=true
    • https://s3.amazonaws.com/nefomojuwet/54637618602.pdf
    • https://f803bf1b-e1c2-47f6-a41f-c9785c88fbd4.filesusr.com/ugd/bf07b1_3f80fc8406d648f298412ddff818ec9e.pdf?index=true
    • https://s3.amazonaws.com/nuxomigo/37738250201.pdf
    • http://kofaxafogi.myartsonline.com/tovoluto.pdf
    • https://s3.amazonaws.com/towakog/berenstain_bears_full_episodes_thanksgiving.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee57.bin
59a7c7e30ea7dcd39d3be2dff88a577023e41a9c8bc370b29188e7da6f1461b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE57 5396 bytes
font_01_sfnt_off000100bd.bin
1625aa45a30458d394e7b8ea645fa0d99e50ef3aad10d53dcad2105b1d4404f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100BD 12260 bytes
font_02_sfnt_off00012aa6.bin
f3d57df04cdb194e46cfff8b4835c5d2f279e7288315b2039a53678039656b22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AA6 16264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.