Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4d66212f4200ac8…

MALICIOUS

PDF

85.6 KB Created: 2021-03-28 11:29:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: bde2d1a0a094d19d37e8cafe902a9881 SHA-1: 709d625a50201c9391977087f459c4213c9eb734 SHA-256: f4d66212f4200ac83dc0caada04ea6e9d9d9362d149fd83cee9c4d90c37cf4fe
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document is identified as malicious by ML classifiers and ClamAV, with heuristics indicating it functions as a link farm and a fake invoice lure. The embedded URL `https://kuzutuzo.ru/wix?keyword=mo+state+personal+property+tax+receipt` is likely used to redirect users to a malicious site. While no scripts were explicitly extracted, the PDF structure and the presence of numerous external links suggest an attempt to exploit users through social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=mo+state+personal+property+tax+receipt PDF link annotation
    • http://tojokepolosuku.iblogger.org/magento2_invoice.pdfIn PDF document text
    • http://pewusimirunoto.22web.org/duwojefuwagap.pdfIn PDF document text
    • http://xexogafuko.22web.org/98972092175.pdfIn PDF document text
    • http://vizozipemovowe.iblogger.org/air_water_and_noise_pollution.pdfIn PDF document text
    • http://lnstagram-blue-badge-form.com/is_there_going_to_be_another_book_series_after_the_trials_of_apollo05q9i.pdfIn PDF document text
    • http://reform-st.ru/asus_27_full_hd_led_monitor_mx279h0m4c3.pdfIn PDF document text
    • http://olymp-trade.top/aace_diabetes_guidelines_powerpointliv4d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gozifep/51641237016.pdfIn PDF document text
    • http://xetorofowuwid.epizy.com/tadelo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebe89359-c69d-4bce-8bae-33b4c9881680/bidofixinovaxemutadewit.pdfIn PDF document text
    • https://6cdb29d4-22ce-4aaf-9e51-562b59d50851.filesusr.com/ugd/1b20fb_0b2d95d2097f4db9a5a9a9df67b5494e.pdf?index=trueIn PDF document text
    • http://kedokonox.rf.gd/robixa.pdfIn PDF document text
    • http://lofadezowudekeg.epizy.com/87390439257.pdfIn PDF document text
    • https://8e12fe21-47c1-448c-af9e-883e7c84523b.filesusr.com/ugd/52ac5e_cc5bb40f0c284cf39b2cd58a8fa3b7ec.pdf?index=trueIn PDF document text
    • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_45fe9d142bd14dc89a4ca499e43b3668.pdf?index=trueIn PDF document text
    • https://7211abc3-b26e-437e-abd8-8a8c7ebd4af5.filesusr.com/ugd/0683fb_88f3c2b9d24b4e42a73f2aab1d151889.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fajujiju/1432926612.pdfIn PDF document text
    • http://kosiwamirofakad.rf.gd/70163276944.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/add9280b-6ddc-41df-8556-949586a8e341/47393562729.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1df504f9-8e93-48d1-a075-d72947cd9f55/dsc_pc1616_change_battery.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/254635ef-2bab-42d6-9174-ceaca211418e/mississippi_state_university_campus_map.pdfIn PDF document text
    • https://s3.amazonaws.com/selivuvumepaveb/bepanah_pyar_theme_song.pdfIn PDF document text
    • https://s3.amazonaws.com/juzowilipi/dispel_thick_bleach_safety_data_sheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ffb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FFB 5104 bytes
SHA-256: e863beeaace239789c5674c1ff2aa48eac728437c989decad45daf4c80713406
font_01_sfnt_off0001217d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1217D 10880 bytes
SHA-256: 2f48eba36b476a0e7668d855fc9b9064f53f4b080acab07fa7a6db24811e3408

Open this report in the interactive analyzer, or submit your own file for analysis.