Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0ea4c0418da4e09…

MALICIOUS

PDF

76.4 KB Created: 2021-03-25 08:55:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c8374735bfc84c4955ea6a8695dc744d SHA-1: 79300d610dade6c723c4b56aa8b49e432a89acd2 SHA-256: d0ea4c0418da4e09dce74c7b944f9b80ca97d5845d0b4d6df6ae6dcf5201d470
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'kuzutuzo.ru', which is likely used to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to a book, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=but+how+do+it+know+book
    • https://cdn-cms.f-static.net/uploads/4477155/normal_600b332b3ad14.pdf
    • https://static.s123-cdn-static.com/uploads/4372963/normal_600880b3d631a.pdf
    • https://cdn-cms.f-static.net/uploads/4367960/normal_5fe91535c738c.pdf
    • https://cdn-cms.f-static.net/uploads/4471474/normal_5fd652e4930a7.pdf
    • https://static.s123-cdn-static.com/uploads/4421781/normal_5fc7a7ab2ad86.pdf
    • http://xuzerujagojagip.scienceontheweb.net/vawizaxefitulibexoritu.pdf
    • https://static.s123-cdn-static.com/uploads/4484805/normal_5feb08919bc39.pdf
    • https://static.s123-cdn-static.com/uploads/4385869/normal_5fc9c7f2037a1.pdf
    • https://cdn-cms.f-static.net/uploads/4366347/normal_603b7c2947131.pdf
    • http://gejokakop.mygamesonline.org/dell_latitude_e5400.pdf
    • https://cdn-cms.f-static.net/uploads/4388413/normal_6029561a021d2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8620e115-6216-466d-8cd5-57f2241bf13c/30_days_to_understanding_the_bible_book.pdf
    • https://s3.amazonaws.com/kujapomib/63059095003.pdf
    • http://donijexufenu.onlinewebshop.net/dragon_age_origins_companions.pdf
    • https://uploads.strikinglycdn.com/files/7787765a-8a48-412a-8bd1-824d124b4a2d/zaxajixoz.pdf
    • https://uploads.strikinglycdn.com/files/009f301d-1753-4f32-8a86-839a2b531a7e/st._croix_pellet_stove_maintenance.pdf
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_bc1ffb1470f04e68b000ee41b6a87589.pdf?index=true
    • https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_aa36ec40420349918112e43b537480bb.pdf?index=true
    • https://s3.amazonaws.com/nufidibodudulad/35423529991.pdf
    • https://s3.amazonaws.com/nefomojuwet/chrissy_teigen_cravings_collection_canada.pdf
    • https://s3.amazonaws.com/zepifudoxapo/ccma_forms_rescission.pdf
    • https://uploads.strikinglycdn.com/files/62ee2f5b-7cae-42e3-a714-7a67c85903bb/85116548541.pdf
    • https://uploads.strikinglycdn.com/files/4f59f54a-036f-421b-a7d4-a513c920dfa0/what_are_the_conventions_of_traditional_literary_genres.pdf
    • https://s3.amazonaws.com/desekusoxi/what_is_a_calluses.pdf
    • https://2b12d24f-0c9a-4a32-b427-430aba395f0c.filesusr.com/ugd/6cfe90_1b8271bdd9a0434db6b9d03367ae6d18.pdf?index=true
    • http://fixidil.atwebpages.com/bangla_to_english_learning_book_free_download.pdf
    • https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_b7cdecb8b3ef4c60b9baf66536e7984e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eba3.bin
45e505e0359753488763527a0248fea562126c90b52c886e4610c69e45306bff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA3 4740 bytes
font_01_sfnt_off0000fbd7.bin
314b47c0af89755ae24a98a982292b8f22143d62c1188ec63185d67ed7e15d50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD7 11808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.