Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8ae43d4ca585ee5…

MALICIOUS

PDF

89.2 KB Created: 2021-04-02 01:48:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 40a8235fde8fe45d324354d818eef9ce SHA-1: 7b2304a17b558d1401e50fdada9677a03f202903 SHA-256: d8ae43d4ca585ee51c2c617b8172e953ef9a71bd49059a48b72e255778273284
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. An external URI pointing to 'kuzutuzo.ru' was extracted, which is likely part of the phishing lure. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=basic+electronics+book+in+hindi+free+download
    • http://joxorapux.22web.org/fidovexagowubikep.pdf
    • https://static.s123-cdn-static.com/uploads/4369493/normal_5ff062e5a76ce.pdf
    • https://cdn-cms.f-static.net/uploads/4460477/normal_5fd2f2b77fe66.pdf
    • https://jufasoxoko.weebly.com/uploads/1/3/5/3/135315704/jerek_bilovelumab_lovepozobi.pdf
    • https://static.s123-cdn-static.com/uploads/4365583/normal_5fec410e645f1.pdf
    • https://tuvitewolejuxow.weebly.com/uploads/1/3/4/6/134615754/bepaxanezin.pdf
    • https://mozesejute.weebly.com/uploads/1/3/1/3/131380505/nabikuzinuzagug.pdf
    • https://cdn-cms.f-static.net/uploads/4484103/normal_60548526c26ad.pdf
    • https://cdn-cms.f-static.net/uploads/4387060/normal_60604cb7a26e7.pdf
    • https://febapemideb.weebly.com/uploads/1/3/0/7/130738739/basokoz.pdf
    • http://rerutexab.iblogger.org/kogefolixuvage.pdf
    • http://pusikoxelumide.iblogger.org/31084970996.pdf
    • http://zuxenegobepejij.22web.org/39816915217.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://madukesizor.epizy.com/intentional_fallacy_wimsatt.pdf
    • http://sitiwaruto.rf.gd/95050666573.pdf
    • http://bideliv.rf.gd/statistics_and_probability_with_applications.pdf
    • https://s3.amazonaws.com/genukopapovixo/78129229794.pdf
    • http://farurujaporibem.epizy.com/cambridge_english_pre_a1_starters.pdf
    • https://s3.amazonaws.com/juzewojavomofew/16247400258.pdf
    • https://s3.amazonaws.com/zaxuledo/implosion_mod_apk_android_1.pdf
    • http://zoletafexogixa.epizy.com/scatter_plot_worksheet_2_answer_key.pdf
    • http://pomezup.epizy.com/bluejeans_recording_format.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd8f.bin
98e3116d47e6eafa54365eb11ce531b6a6990e4aa2417c4cd7da7a9abbc21966		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD8F 5452 bytes
font_01_sfnt_off00011025.bin
bf254c0993ee890ef4b8fee4b83bee763e7f7e5a239825bf752a20651bffc5d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11025 11564 bytes
font_02_sfnt_off00013717.bin
086329dc82da894d5764a2814b5dbb1986fd1afd0123af04f4a69b0876cb85ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13717 9800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.