Malicious PDF — malware analysis report

Static analysis result for SHA-256 04b4e37c75d2f97e…

MALICIOUS

PDF

102.4 KB Created: 2021-04-17 11:17:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a3ffd7444b35bc8098eccbaeb15c96f6 SHA-1: c602ce076e566453c384161c64fe50cfd6c60900 SHA-256: 04b4e37c75d2f97ef97217e70ecf5d79877d53f5ebbc17476af42d0f58d0c933
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain 'resalured.ru' that is likely used for phishing or distributing further malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed to host many links on disposable domains, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=altered+carbon+resleeved+2+%25E0%25B8%259E%25E0%25B8%25B2%25E0%25B8%2581%25E0%25B8%25A2%25E0%25B9%258C%25E0%25B9%2584%25E0%25B8%2597%25E0%25B8%25A2 PDF link annotation
    • http://gepokupaburorew.mywebcommunity.org/inspirational_quotes_for_students_in_college.pdfIn PDF document text
    • http://daliadiago.com/basic_seismic_processingf0bye.pdfIn PDF document text
    • http://pijojavoto.mygamesonline.org/animation_meaning.pdfIn PDF document text
    • http://larokamexi.sportsontheweb.net/fanuvopazezebewape.pdfIn PDF document text
    • http://palogaza.sportsontheweb.net/rearrange_pages_sejda.pdfIn PDF document text
    • https://cdn.sqhk.co/pajokiman/iaZgdhc/icon_clash_nike_sweats.pdfIn PDF document text
    • http://xidasetetobuge.scienceontheweb.net/cholesterol_diet_in_telugu.pdfIn PDF document text
    • https://cdn.sqhk.co/videgogaf/bgghage/fozogojaniji.pdfIn PDF document text
    • https://cdn.sqhk.co/dosovejozeb/jdicnYz/android_appcompat_actionbar_text_color.pdfIn PDF document text
    • http://particulier-societegenerale.xyz/nobatgklv4.pdfIn PDF document text
    • https://cdn.sqhk.co/ninilevikod/iit2tjf/84214194533.pdfIn PDF document text
    • https://cdn.sqhk.co/wirowanorax/idvrQha/jezuvifejujijozepesu.pdfIn PDF document text
    • http://tamakar.xyz/40019128104iypdj.pdfIn PDF document text
    • https://cdn.sqhk.co/kigimole/hjhfIhi/44107227984.pdfIn PDF document text
    • https://cdn.sqhk.co/bomumuxa/F5vhajh/xanokamuxazoves.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fad3a94e-c442-4cb4-b759-7ffeb6f54289/wozavusamiwisalesoxipibew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e00a79e-739b-4277-af08-86563ecd07ac/how_to_use_netgear_prosafe_5_port_gigabit_switch.pdfIn PDF document text
    • https://s3.amazonaws.com/xeroguru/33117475422.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93d9a23e-c036-46bf-bc3e-83a6d0ce9e3c/how_does_rapid_diagnostic_test_for_malaria_work.pdfIn PDF document text
    • https://s3.amazonaws.com/kafises/4186724517.pdfIn PDF document text
    • https://s3.amazonaws.com/zunaduxa/instrumen_survei_akreditasi_puskesmas_2016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e50d58c-327f-4d25-a039-7cc9b26adc26/nosumemifiri.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000135e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x135E7 15952 bytes
SHA-256: cb10e18659579a72f81ea0ddb60bb1cb8fce58ba0cfb90aebf4837c1853eff4a
font_00_sfnt_off0001120e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1120E 5252 bytes
SHA-256: d74b55b1023c7c85b7d6cd4fee256de7cb5289e8092dbec4e468bd553d7dad68
font_01_sfnt_off000123f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123F6 6768 bytes
SHA-256: 2751db959e0dc68e6ffa5f0009ca6fc06b991675eec5f7acd3fde582f95aef69
font_03_sfnt_off00016204.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16204 11004 bytes
SHA-256: 908493f85e8e6fc5eb83d92fa4a8db7e6d60b0257b4da6d018ee27c996dca544