Malicious PDF — malware analysis report

Static analysis result for SHA-256 e891474c5df47c00…

MALICIOUS

PDF

78.1 KB Created: 2021-03-11 07:39:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6b9ff6f2874f9086df34d88019d47d59 SHA-1: b0e470cfc208d80c0a7043c298649d0a92637fe3 SHA-256: e891474c5df47c00d3bbfce86cbff22771b7ed4b2bd432068a420f32ef624ae7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'kuzutuzo.ru' suggests the document is designed to redirect users to a potentially harmful website. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=rage+juggernaut+guide
    • https://static.s123-cdn-static.com/uploads/4454425/normal_5fc72d589467f.pdf
    • http://microbestdigitalmeter.xyz/cook_once_eat_all_weekhpfmk.pdf
    • https://cdn.sqhk.co/dirodivive/VInEhbM/planets_from_the_sun_to_pluto.pdf
    • https://static.s123-cdn-static.com/uploads/4385648/normal_5ffd3a6c2c4e4.pdf
    • http://beststudent.fun/vewusugemidisafugiminixph9pq.pdf
    • https://static.s123-cdn-static.com/uploads/4454541/normal_5fdecb76441d0.pdf
    • https://cdn.sqhk.co/disumuneriva/fm2ggjd/jivonezekeziwugivevok.pdf
    • http://ehaberdevlet.com/pifuzofajewonivixup1uvxw.pdf
    • https://cdn-cms.f-static.net/uploads/4454049/normal_6032c850b5c02.pdf
    • https://cdn.sqhk.co/xidatelo/ifhbsgj/vokugabexakidemevewamik.pdf
    • https://static.s123-cdn-static.com/uploads/4463034/normal_5ff64a5c2f07d.pdf
    • http://lnstagram-help-businesss.com/causes_of_bantu_migration404iz.pdf
    • http://siondez.ru/2204981748p57il.pdf
    • http://legalvictory.group/54424771479sgeum.pdf
    • http://show-visitor.xyz/mujavifuketafojfkyh.pdf
    • https://cdn-cms.f-static.net/uploads/4467300/normal_600b3a9dc610e.pdf
    • https://cdn-cms.f-static.net/uploads/4425492/normal_602ff64c8b56c.pdf
    • https://cdn.sqhk.co/puxolika/gjgh1ja/50895698618.pdf
    • https://cdn-cms.f-static.net/uploads/4457592/normal_6031313c50b1d.pdf
    • http://gufutaca3.xyz/66866730142o9inh.pdf
    • http://purpless.vip/internet_archive_booksggqvu.pdf
    • https://cdn.sqhk.co/mofokamibe/Sge20vg/formula_1_racing_games_online.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2080fafa-2491-4ac3-8118-a138f33bff34.filesusr.com/ugd/822ecd_8747d8962160453ea04db7a62734e9d2.pdf?index=true
    • https://fbaba6ab-37cf-477f-82bd-e10a416eccda.filesusr.com/ugd/3c8574_4f8315d94d794dd5be32a12d3e0f0780.pdf?index=true
    • https://71a5d838-4e22-4830-8da1-7955ec3365f5.filesusr.com/ugd/f2f43e_df9f16cfb3af47d395d4151547993d20.pdf?index=true
    • https://661c91a2-68a2-4ae3-aaac-ef96b6cc7894.filesusr.com/ugd/b926a8_0511b72fabaf4ffe92d614b7a56109d2.pdf?index=true
    • https://e209d09f-5af8-48a0-acfc-72d03e9bea0d.filesusr.com/ugd/946fcc_0f45db635170466c95116125dcadd975.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f707.bin
a75a93d2d876be52d7b76e5f1272f3c046eb3835b59319703cdeeb5ebd581807		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF707 4864 bytes
font_01_sfnt_off000107aa.bin
908337a87502639b6b72c375406d75a0edcc43fca48c4950744c515b3b8ee813		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107AA 10368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.