Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebfe354c7e78fd3e…

MALICIOUS

PDF

70.9 KB Created: 2021-05-19 18:29:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: cfbef2fa64d95a5ce2d8e20eed73c9d8 SHA-1: ee04c52580d6212a3d6e9545f0ad5f2ec4c88e31 SHA-256: ebfe354c7e78fd3e9aa534327e89dd2e66e72235a3d10002393d87df373b4791
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high probability of malicious intent. The presence of an external URI pointing to 'kuzutuzo.ru' suggests a phishing or malware distribution attempt. Although the document body is heavily obfuscated, the heuristic 'SE_URGENCY_LURE' suggests the document attempts to create a false sense of urgency to prompt user interaction with the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+long+to+charge+welch+allyn+otoscope+handle PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4422622/normal_60274a89b346e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474169/normal_605c0d14da69c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476301/normal_6068c5ead0630.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485704/normal_605a2bb30e7b6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411250/normal_60623bf2c0e11.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417995/normal_602b873ecbb45.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476427/normal_5ff303f8b938e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417306/normal_6035931741396.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501374/normal_5fe1161f9587a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/698360cd-f836-4dc3-aa3d-b453ec980d25/jalozojafenabejulavumuxo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/595ab5a8-533f-4c36-83be-2d97b1b739e9/first_grade_math_addition_worksheets_printable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba7478ca-692b-4c5f-b0d0-ca0854f5e737/xulibofam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f416e31-fa12-40a6-8c9f-effa79b0ad5d/json_tutorial_c.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36337b24-c2c5-4577-a6ab-013031f82a02/honda_eu2000i_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bb149ab-78d3-465f-9382-c2711f0f00f7/62571562961.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0b8e95e-7633-4d8f-a367-f96fd10b690f/zane_grey_book_set_in_australia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a997daed-3b76-4713-909f-04cef7d4b8da/cessna_310_maintenance_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5673b778-26bf-4b31-9158-f4a717429526/33944498175.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ea1bc27-4a94-4c48-ab34-c7f13e2d56b6/fovotadezevigofawos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ac03526-0adf-4351-9153-13ea36d5322d/navy_technical_directives.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d63e554f-87ea-4cfa-90f7-af8a5f5d0641/parrot_bluetooth_mki9100_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d45e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD45E 5488 bytes
SHA-256: 6cd9de81bf286c223b87df908d1c75cadfe07598615aa92d2a4098ef0cc25bac
font_01_sfnt_off0000e719.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE719 10816 bytes
SHA-256: cc766f4a38ceb83a11bb6e64c8f379217c506e78a51ad648f1c88b8877407c55

Open this report in the interactive analyzer, or submit your own file for analysis.