Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef344da7f3efdf2a…

MALICIOUS

PDF

81.0 KB Created: 2021-03-14 20:08:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e1482cf416c886064e85e43bbbeacb8e SHA-1: dbd6e1104d2c121e32f368fc9ab4144e1a8b9cfe SHA-256: ef344da7f3efdf2acff01069a198993a2d289c8462ac618959be06e461c0f2ef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL 'https://kuzutuzo.ru/wix?keyword=norton+antivirus+cracked+apk' suggests a lure for users seeking cracked software, which is a common phishing tactic. Although no scripts were extracted, the PDF structure and embedded URI are sufficient to infer a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=norton+antivirus+cracked+apk
    • https://cdn.sqhk.co/wularumijif/WZhiie2/rugimerokusuzob.pdf
    • http://criticcxck.space/48577136889jnws2.pdf
    • http://bu-markett.com/spirit_run_multiplayer_battle_modtf7ri.pdf
    • https://cdn.sqhk.co/kufagilan/dXmjh5O/satavaxobados.pdf
    • https://cdn.sqhk.co/fakozunada/iiXjhii/hearts_on_fire_song.pdf
    • http://probnik1313.tech/17564049707dt87x.pdf
    • http://mini-cam-v2.club/bhakti_geet_bhajanmafdb.pdf
    • https://cdn.sqhk.co/goworonol/qCPWgin/do_platy_fish_give_live_birth.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_92ccad8349c0436386edc39678c9f18f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8ee1e87f-40a0-42b7-98d3-c67074f88368/how_does_materials_engineer_make_use_of_chemistry.pdf
    • https://2f2ab42d-e0b4-4bd3-aa50-2430da1ff5fc.filesusr.com/ugd/eaf48f_1a2182b90aa643a2897df96f6a9f194f.pdf?index=true
    • https://53ebb62d-ddaf-432f-8dc3-1f4746653467.filesusr.com/ugd/bbd3cf_059131ee7bae47d3a12fb50848774f5a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b15c8ada-96a7-41e6-962a-64b6dabe90ec/what_is_papa_johns_crust_made_of.pdf
    • https://s3.amazonaws.com/lixuduwonifa/87254481488.pdf
    • https://uploads.strikinglycdn.com/files/93e9bb51-f55c-4f5c-ba35-9175bd84f03d/silver_lunar_3_maus_gold.pdf
    • https://413f70bc-0247-4a04-a3fc-eabb14e2b93f.filesusr.com/ugd/f18ee6_3c9847fffc934edcac465d572e68f826.pdf?index=true
    • https://d3df31c7-72fe-42b1-a92e-0723e8ed7a16.filesusr.com/ugd/5bf82b_8e1639deff8c45ca94b6e79806485196.pdf?index=true
    • https://s3.amazonaws.com/loxopudizus/7214061663.pdf
    • https://uploads.strikinglycdn.com/files/51cde99f-2556-4e46-878a-9850f466b199/what_would_cause_a_lawn_mower_not_to_start.pdf
    • https://s3.amazonaws.com/rufonali/koreke.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000feb1.bin
7c5d3af53bb85ef532db740f6ce803e452220f0a3ac3cfad1d9415e3058efab6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEB1 5128 bytes
font_01_sfnt_off00011043.bin
83c0ecfedfeffb7862a0634d15a955595f042e6d7dde2178005cef13923398e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11043 11208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.