Malicious PDF — malware analysis report

Static analysis result for SHA-256 04f6f513f9116607…

MALICIOUS

PDF

80.6 KB Created: 2021-04-23 02:37:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 197e7974ac0f9950ba11266ea0560be3 SHA-1: d4ecc88ddc05cb737a25cc932b0ad0d77ca3dea0 SHA-256: 04f6f513f9116607083a90f64e46dedbeee5b206d510d106eea9b4e716dfc3e6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://resalured.ru/strik?utm_term=lowrance+elite+4+chirp+transducer', which is likely used to deliver a secondary payload or conduct phishing. The document body appears to be corrupted or obfuscated, preventing a clear understanding of its specific lure, but the presence of the malicious URL strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=lowrance+elite+4+chirp+transducer PDF link annotation
    • http://pixunune.sportsontheweb.net/what_is_big_data_and_analytics.pdfIn PDF document text
    • http://zesenadozefut.sportsontheweb.net/ruwofusalirowazaxavol.pdfIn PDF document text
    • http://totipuzuforaz.mywebcommunity.org/31192357206.pdfIn PDF document text
    • http://003-center.ru/295250667193q4ll.pdfIn PDF document text
    • http://livethailand.fun/war_planet_apes_tamil_dubbed_movieh3tfd.pdfIn PDF document text
    • http://ritixibetono.mygamesonline.org/68478489539.pdfIn PDF document text
    • http://xogavuw.medianewsonline.com/fairy_tales_stories_in_tamil_download.pdfIn PDF document text
    • http://gallery-shop.site/tp-link_tl-wr700n_manual_espaoln4412.pdfIn PDF document text
    • http://kerutugizuxig.mygamesonline.org/gunoviviwoganakitowe.pdfIn PDF document text
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdfIn PDF document text
    • http://springital.fun/aditya_varma_bgm_ringtonet5g58.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nerugiraxura/brochure_template_photoshop_free.pdfIn PDF document text
    • https://s3.amazonaws.com/laradusa/kat._cr_bollywood_movies.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba45c7c3-6f78-4ee6-abac-a78519364b7e/transition_words_and_phrases_for_middle_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48558445-244f-4696-93ac-92ea490402ae/mixubizopelerogaxe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39da193a-ca9f-49ff-b8b5-38d93511efd9/cuntas_veces_es_normal_orinar_en_el_embarazo.pdfIn PDF document text
    • https://s3.amazonaws.com/veledabejufi/muxatozofugo.pdfIn PDF document text
    • https://s3.amazonaws.com/neviwove/wejilubinudapemeve.pdfIn PDF document text
    • https://s3.amazonaws.com/tikoweravisixu/26149786434.pdfIn PDF document text
    • https://s3.amazonaws.com/gixawetopoli/dilosafebeligitoluvubor.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/90245157198.pdfIn PDF document text
    • https://s3.amazonaws.com/purufiz/akshay_dhawan_last_performance.pdfIn PDF document text
    • https://s3.amazonaws.com/dudigonifu/32175640770.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b41f1fe-b152-4da5-8705-e9c2559c71ad/what_is_anti_human_trafficking_law.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD04 5284 bytes
SHA-256: e10387eef626ec2b255d73e55df459b64bdd634a19436c6a7e75347d6bcda6f4
font_01_sfnt_off00010f09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F09 11200 bytes
SHA-256: 27449e74c3d5228cd497c104cbd7daa12300fdcf558146debc481f0d405aad8a

Open this report in the interactive analyzer, or submit your own file for analysis.