Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2b6953cfe59eb1d…

MALICIOUS

PDF

89.1 KB Created: 2021-03-22 05:40:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a5b794fb7a93f9ea6ec23646c9477df SHA-1: 929e894a6a22b37d44fc65f442bbc286475d1cdd SHA-256: d2b6953cfe59eb1d8fed3b3dbbc8474baa3a358157da787b3ed1abbb488557a2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external URIs points to 'https://kuzutuzo.ru/wix?keyword=divine+order+in+the+bible', and another significant link is to 'https://sujosajuzatitoz.weebly.com/uploads/1/3/5/3/135312362/f500ad0e53ac.pdf'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or distributing further malware through the linked content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=divine+order+in+the+bible
    • https://sujosajuzatitoz.weebly.com/uploads/1/3/5/3/135312362/f500ad0e53ac.pdf
    • https://cdn-cms.f-static.net/uploads/4413347/normal_602b8940cf263.pdf
    • https://cdn-cms.f-static.net/uploads/4467915/normal_5fdbca788bb68.pdf
    • https://wenojuzak.weebly.com/uploads/1/3/4/2/134265903/7354347.pdf
    • https://cdn-cms.f-static.net/uploads/4486035/normal_603b31ffe408a.pdf
    • https://cdn-cms.f-static.net/uploads/4473064/normal_6035f6d3216a8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xerevim.epizy.com/kalnirnay_calendar_june_2020_marathi.pdf
    • https://uploads.strikinglycdn.com/files/ee9544fe-5603-41e1-aa86-a31f58fd3859/who_is_the_father_of_cognitive_theory.pdf
    • http://rolizixi.rf.gd/xirodudasusituzew.pdf
    • https://uploads.strikinglycdn.com/files/68ff76a6-24b2-42e7-82f0-4734d9377727/60806661326.pdf
    • https://435a888a-8f80-410d-aa77-77edd6e4491d.filesusr.com/ugd/51fec0_088be8b5fc6149938fff2eb6b0de9cb5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e50c1681-65b7-4eaa-af6d-30c53d9c264f/zofosalibipiden.pdf
    • https://uploads.strikinglycdn.com/files/ad3150de-2f79-4f70-88a9-793a628c614d/2013_chevrolet_cruze_lt_owners_manual.pdf
    • https://9f61dd91-ea7e-4edc-a837-c43fae5dccfb.filesusr.com/ugd/ed897c_3ff51432f14641fd9dfa72479be1fa1d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a3ac4124-14d3-4016-a6f9-bbad1b982786/xanopigano.pdf
    • https://uploads.strikinglycdn.com/files/d729fe49-d218-4986-aec4-43f6c43293b4/georgia_drivers_handbook_2020.pdf
    • https://uploads.strikinglycdn.com/files/3137fc8a-9992-45b6-b18a-7bf66aafd37f/5_themes_of_geography_questions_and_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000123ad.bin
b30f9230d7702db9911f9b8504d9e0cfde349e26d4bc3b9cd58cd9be776990f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123AD 4724 bytes
font_01_sfnt_off000133bd.bin
7c03e10a5bca8d1190204e0fd4cb66cfa40cffb5f11d93f3e9a633d27fda5244		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133BD 10552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.