Malicious PDF — malware analysis report

Static analysis result for SHA-256 e79a72d2d67cd0fd…

MALICIOUS

PDF

77.2 KB Created: 2021-05-28 13:51:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 572c0ec6259f0fd142d968f257e2a41a SHA-1: e7ed1d950672b63b905e2464cc484b8592bfd306 SHA-256: e79a72d2d67cd0fdc02087f5091d32119bc9c2805edd3ee012adee46e66fe7e8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'mezovuduw.ru', which is likely used to redirect users to a phishing site or download further malicious content. The presence of PDF-specific heuristics further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=islam+%25C3%25B6ncesi+t%25C3%25BCrk+edebiyat%25C4%25B1+%25C3%25A7%25C4%25B1km%25C4%25B1%25C5%259F+sorular PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4414701/normal_606bc3da6e6b2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391599/normal_5fe9a697961d8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454299/normal_606be40aed72b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456119/normal_5fca9aa26744d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444643/normal_602a7327083c7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457281/normal_6007fd7ede2a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405638/normal_6057b7932e9e2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/62e9712d-eae0-457f-a53e-9c33b13fb88c/76907350333.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db018ffd-8e40-4f67-898f-8c8fbd75528e/map_of_the_world_with_latitude_and_longitude_and_countries_and_cities.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82b8982f-d9f7-4c5c-b584-ae803f7dd45a/gowijujibexawubarike.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/891b79a2-876e-4e42-b2ae-e1bcb23c5a94/13052225394.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fd1deaf-38e1-4ebb-a5c5-21382b5787b4/tibusaxokizufepedejivusor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/054f689e-c7df-48cd-b92b-2554f1a2dc60/the_ascension_mysteries_audiobook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/802a6e90-32d9-4438-9129-af33a32f8264/fifty_shades_of_grey_3_full_movie_in_hindi_dubbed_download_300mb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf6f9de5-3b8b-46cf-9d92-4ddc8f053b76/is_potassium_perchlorate_legal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a4062fc-96d9-4b4c-a38f-415a9a680192/tipo_de_premios_para_funcionarios.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f76db12f-0d60-4295-957a-af7c24c390fc/sam_patch_the_famous_jumper_sparknotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9010d21-a804-4c9a-9cf4-2191f4c4604d/xenefuje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad71da3c-545a-4852-834e-2097be0cbe12/2334705640.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3cd158e2-6d37-4863-9d8d-9c3c8bf442f2/mezazegobiduneg.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB9 6048 bytes
SHA-256: 417c2cab8057a37bd30070f0f336a21b8ae4e74bf7ad4dc3b14ac75632e6bf66
font_01_sfnt_off0000fec8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEC8 12364 bytes
SHA-256: 32a79c61fcc5a873687a5d23189e51862f1f503a7067c9ecf7751230163e85d9

Open this report in the interactive analyzer, or submit your own file for analysis.