Malicious PDF — malware analysis report

Static analysis result for SHA-256 d73e90dc361ba5a8…

MALICIOUS

PDF

70.2 KB Created: 2021-03-31 03:52:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ba264c844effef996292617ea7a537b1 SHA-1: 6699575cbb118ab7f1d76c14765d3856f7872160 SHA-256: d73e90dc361ba5a8303910facd145360e489c83f3da148ec4a22d080e10048da
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, mezovuduw.ru, which is likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to search results or downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=cessna+182+skylane+rtf
    • https://cdn.sqhk.co/romumoxoleno/jehjGjb/ashampoo_burning_studio_free_for_pc.pdf
    • https://cdn.sqhk.co/kewudomavave/ge2rjhL/grow_empire_rome_cheats_2018_ios.pdf
    • https://cdn.sqhk.co/zomuzuta/Wkf0jb0/veguvovemuda.pdf
    • https://cdn.sqhk.co/rijomawonuj/ifx1oCW/ramp_car_stunt_game_video.pdf
    • https://cdn.sqhk.co/diratukuz/UG35unZ/hell_ride_2008_full_movie.pdf
    • https://cdn.sqhk.co/kewesowovim/kgjdaIO/pottery_designs_pinterest.pdf
    • http://wbigs.space/11727054613q4lq8.pdf
    • http://sberbank.services/mein_schiff_6_deckplantaolr.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://16fd3b15-5541-4454-9538-28daacbf497e.filesusr.com/ugd/e32576_c47563284172482d815c76713c31f9d0.pdf?index=true
    • https://06ebba1c-c738-45d4-b58d-83edbdcc9420.filesusr.com/ugd/b14caa_9d0be1075c8f4b45b61a84523a4e3003.pdf?index=true
    • https://e9abb47e-19e5-4ec2-9f3c-2aa4e6f2bf0a.filesusr.com/ugd/92be99_8808dffbd8d042ca95c17acb54b90b36.pdf?index=true
    • https://s3.amazonaws.com/setikizo/zekilagomuxuvope.pdf
    • https://uploads.strikinglycdn.com/files/d6642870-d5ad-44dc-b0c3-760a7cd8d73e/devops_handbook_part_3.pdf
    • https://uploads.strikinglycdn.com/files/31dd120d-3528-42cb-bf4e-710849d76c63/91888947252.pdf
    • https://uploads.strikinglycdn.com/files/a94a03e4-f782-4d6c-84ed-cae1dd269600/fomuzux.pdf
    • https://bb209e34-24c3-4901-88bd-c00af8cda710.filesusr.com/ugd/de6798_9ac022f80153402c854997b697dcf709.pdf?index=true
    • https://s3.amazonaws.com/jipowumat/osrs_kandarin_easy_diary_guide.pdf
    • https://uploads.strikinglycdn.com/files/e6192d95-65e4-45c8-a2b3-68b839f63a13/34117827194.pdf
    • https://uploads.strikinglycdn.com/files/c6c8dff3-7a70-4c09-b00d-6a4e27fc2dc0/zirosanokanuvavuzesep.pdf
    • https://d4f1f58f-bd44-402a-a4b0-a3aa01e36dbf.filesusr.com/ugd/dffefa_35353048b386487f921954449f55b1b4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d198.bin
7bf22ae27173c0780c0a0be77350e8784960f9e4a860bc5deff14318e6b60204		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD198 5208 bytes
font_01_sfnt_off0000e36b.bin
8bc0f1c98bdb9c2a07c872256510a4cdaf4c68a51851d7d05d506485294627fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE36B 12800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.