Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6998b79fdcf0803…

MALICIOUS

PDF

88.5 KB Created: 2021-03-17 03:25:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f99025c52b0e0b1398874cdbf13e616e SHA-1: 1c0eedc8f37626496b7e324bc4ca5a2d9c70bf8c SHA-256: e6998b79fdcf08030f012def7b50966f233814d8d50f711224d143c5f1da3742
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to unlocking Sentry safes, which serves as a lure. The presence of numerous external URIs, including one pointing to 'kuzutuzo.ru', suggests an attempt to redirect the user to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+to+unlock+sentry+safe+1100+without+key
    • https://cdn-cms.f-static.net/uploads/4471273/normal_60388de8ac537.pdf
    • http://viputixezererej.66ghz.com/christmas_carols_guitar_chords.pdf
    • https://cdn.sqhk.co/xewafazuk/kNhdTQ7/baworujixil.pdf
    • https://cdn-cms.f-static.net/uploads/4470221/normal_6014f77a4ea7b.pdf
    • https://cdn.sqhk.co/mipekakiri/Rijekii/29757540044.pdf
    • http://banuzatama.22web.org/best_resources_for_personal_trainers.pdf
    • https://cdn-cms.f-static.net/uploads/4389805/normal_601ddffa8375d.pdf
    • https://static.s123-cdn-static.com/uploads/4415077/normal_5fe54dd52e083.pdf
    • http://jogegeve.22web.org/xofanupejuk.pdf
    • https://static.s123-cdn-static.com/uploads/4381085/normal_60081d3348166.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://didajuna.rf.gd/free_email_signature_templates_outlook.pdf
    • http://furofazitogo.epizy.com/camera_360_application_for_android.pdf
    • http://gaxodisesi.rf.gd/96677265934.pdf
    • https://uploads.strikinglycdn.com/files/8e950439-f000-4c21-ba40-875b260a2627/bobemoguso.pdf
    • http://divapikej.rf.gd/can_i_play_metal_gear_solid_3_on_ps4.pdf
    • http://vevidukasi.epizy.com/77905697175.pdf
    • https://uploads.strikinglycdn.com/files/78f6e7ef-f2fe-4eb3-b57e-fee73109574c/56801687838.pdf
    • http://xifetofaramil.rf.gd/out_of_sight_out_of_mind_meaning_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/9ad62d91-8bdd-4f8d-8e85-b58f9e85f5bb/2012_dodge_durango_citadel_v8.pdf
    • https://uploads.strikinglycdn.com/files/89785756-4f36-4c93-9296-55ceeff409b4/jatasaladebo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000118ae.bin
a2fd78cf673ec0f2b59f007c03707797c24b8cd58ab3221f2a2225b0d83ed6c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118AE 5384 bytes
font_01_sfnt_off00012b14.bin
c7fbae8f8082f99dba48d831174c41985d3be98c521c5c35ec7cf887c8a551cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B14 12196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.