Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed137d8d78a1ef11…

MALICIOUS

PDF

80.2 KB Created: 2021-03-20 19:38:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cbbf0c93d62ea40f65c615d2aeb3ec4e SHA-1: 9e208563bb75408ecd96b6ea0952d715d0791f08 SHA-256: ed137d8d78a1ef11b7e51be23ba43bd6cc63e576a894f6d1e60062875ad3e7d4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many of which are likely part of a link farm designed to direct users to malicious content. One of the primary URLs identified is `https://kuzutuzo.ru/aws?utm_term=legend+by+marie+lu+character+analysis`, which appears to be a lure for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/aws?utm_term=legend+by+marie+lu+character+analysis
    • https://cdn.sqhk.co/ruwopazeg/svCgejh/sejinoloxagidil.pdf
    • https://static.s123-cdn-static.com/uploads/4483346/normal_5fe23ecdbdf90.pdf
    • https://cdn.sqhk.co/ragekasa/ijPigeV/ruzorepogepidomajawofigiw.pdf
    • https://cdn-cms.f-static.net/uploads/4461498/normal_5fe9935c5aba8.pdf
    • https://cdn.sqhk.co/widafopaj/haQKhbQ/miniwijuxepudaro.pdf
    • https://static.s123-cdn-static.com/uploads/4381085/normal_5ff2bc290c9dc.pdf
    • https://cdn.sqhk.co/xenudipu/0ghegcK/hbr_global_resources_sdn_bhd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_759c7e14d8e24b2b8b0db57b7ad70400.pdf?index=true
    • https://uploads.strikinglycdn.com/files/23046309-87f3-4264-a958-22303fdd900a/what_does_f2_mean_on_my_sunbeam_heating_blanket.pdf
    • https://uploads.strikinglycdn.com/files/656f1652-f2ea-4fa6-bfd8-4afaca65c73b/sccm_install_logs_location.pdf
    • https://uploads.strikinglycdn.com/files/bd1c8db6-b599-4a87-a9a9-c6f11fa149b1/ruxorulumalavefotewebos.pdf
    • https://uploads.strikinglycdn.com/files/2fda114c-e362-45e3-bbbe-f9896fde6501/all_religions_based_on_astrology.pdf
    • https://4fd7ac12-06e8-439c-96a9-7636004ccb32.filesusr.com/ugd/9554ab_0249d1185b5d469fac2e7b73afd45169.pdf?index=true
    • https://599b09cd-7b6a-4758-94a3-08a08d316165.filesusr.com/ugd/628a76_af531193bbaa49beab61f42630e48a15.pdf?index=true
    • https://33fe1336-4051-433c-b691-b763732126dd.filesusr.com/ugd/6c8f37_0d9978991ed44e1994ddddb00d3c54e8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/af961cb1-fc19-4ba0-a476-4aa15804bb51/boss_baby_1st_birthday_party_girl.pdf
    • https://22520ec4-2132-45a5-98b8-54db1b71d3ea.filesusr.com/ugd/b33b96_63a20f465cb443059fb9b11a077b50a1.pdf?index=true
    • http://pubedirezenara.epizy.com/how_to_print_password_hp_deskjet_2545.pdf
    • http://kopinakitiwodad.rf.gd/34882712841.pdf
    • https://uploads.strikinglycdn.com/files/a89700eb-b2ee-4a89-b5ca-e7db5efdf1cd/the_eyes_of_the_dragon.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8f2.bin
d7e80b9277f1978b4d270ad9f2eeace50977f4d50e336865c1127335ae7560db		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8F2 5536 bytes
font_01_sfnt_off00010b9a.bin
4d0ff33860e9d9aad1db77fae9f2025b912a7deb3bdfbe850605b57927d4b8f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B9A 11108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.