Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd7804b88affcddc…

MALICIOUS

PDF

97.5 KB Created: 2021-03-06 22:30:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: ff20a0479561922398f3bdd564446864 SHA-1: 769e58a3d148af5d7ad7b8b1b4d6145af172746c SHA-256: fd7804b88affcddce9cbe76849cc2f8e2af4dcdd2cd98c90401736801b146b02
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'kuzutuzo.ru' was extracted, suggesting the document's purpose is to redirect users to a potentially harmful website. No scripts were extracted, but the presence of an embedded URL strongly suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=2012+dodge+durango+citadel+v8 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4474978/normal_60109b1069020.pdfIn PDF document text
    • https://cdn.sqhk.co/sugefixa/fiiTicr/house_electrical_wiring_diagram_uk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387929/normal_60216ee9e5332.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482424/normal_603b27c7593a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420018/normal_603c34742e913.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420902/normal_6036aea16e719.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408711/normal_6038bf23afa79.pdfIn PDF document text
    • https://cdn.sqhk.co/kujufemom/6Bhegip/zemuro.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/71f6cca7-cdac-43e9-8dcc-f52e3b4ebacc/how_to_rap_fast_on_beat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42556b84-ed6a-418b-958f-b87a89436f18/zugubid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d9d1756-0c15-4f39-ab6e-6d366f83c07f/74722375193.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5029df9f-d2e9-452a-a8b8-6ad6295883d1/why_is_pimping_illegal.pdfIn PDF document text
    • https://s3.amazonaws.com/budovewesekaz/abba_happy_new_year_mp4_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4f1ca88-5798-4e44-a522-c1bd021dd5d5/como_planear_un_taller_de_capacitacion.pdfIn PDF document text
    • https://s3.amazonaws.com/bufexa/zogusebowetovefidame.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f3412989-9c59-430a-804e-8d21efe04461/kitab_ruqyah_syariah.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000128b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128B8 5416 bytes
SHA-256: 898a60e5af93d951beff2568e3ed96eecd9d0c29cb50b98d5a4669676cba979e
font_01_sfnt_off00013b3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B3D 12100 bytes
SHA-256: f318437fd5faf38a51f82a306f3ec69e12e004689fd42ad34da9595ff17f743d
font_02_sfnt_off00016438.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16438 16060 bytes
SHA-256: 713933360072c9d59346590fad668f98c3603c6d2b72ed941ce85481f6af0b74

Open this report in the interactive analyzer, or submit your own file for analysis.