Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6ce595735c48fed…

MALICIOUS

PDF

72.9 KB Created: 2021-03-14 20:56:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44a066ad248ee01eb9c6ba0a0a017cea SHA-1: 7d8932e3a0deb46316332637d414c17b6c1be0dc SHA-256: e6ce595735c48feddaa25614d83693d5f033355d2e0c3da2a2cf936c1e2440a3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a heuristic indicating an external URI. The embedded URL `https://kuzutuzo.ru/award?keyword=warhammer+bestiariusz+pdf+chomikuj` suggests a phishing or social engineering lure, likely attempting to trick the user into downloading further malware or visiting a malicious site. No scripts were extracted, but the PDF structure and heuristics point towards a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=warhammer+bestiariusz+pdf+chomikuj
    • http://fulukegoror.getenjoyment.net/10559778331.pdf
    • http://mazejofeg.mygamesonline.org/eimeria_tenella_life_cycle.pdf
    • http://jisutuxoxaza.medianewsonline.com/42955469147.pdf
    • http://ellmax-site.xyz/mitsubishi_tv_user_manual5hyd2.pdf
    • http://raisinslabs.club/likeg0hxgc.pdf
    • http://xamipofu.22web.org/the_raven_movie_2020.pdf
    • http://gijaninapumobe.sportsontheweb.net/jenegedetazugatuvike.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tinezedu/82174262130.pdf
    • http://faleferesevo.onlinewebshop.net/how_to_help_prevent_climate_change.pdf
    • http://wiwosotu.myartsonline.com/how_do_i_change_my_honeywell_thermostat_to_celsius.pdf
    • http://widifusi.myartsonline.com/mathematical_constants_finch.pdf
    • http://pulitisagot.atwebpages.com/install_driver_brother_mfc-8950dw.pdf
    • https://s3.amazonaws.com/tibanepoxilibud/pujidez.pdf
    • https://s3.amazonaws.com/kozibowisenatu/22950532450.pdf
    • http://saxarivoje.onlinewebshop.net/dupenixavep.pdf
    • http://punexowimuseva.epizy.com/vaults_of_atziri_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dafb.bin
22bc5b07f456162c6cf752acd9593549987b1177e58e5339497ce0f17c3d1f22		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDAFB 5704 bytes
font_01_sfnt_off0000ee53.bin
dbe5b0b3b1e0d86840a1160a27738e1bb66c6a0b2539b8b4013390c259c0e512		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE53 12076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.