Malicious PDF — malware analysis report

Static analysis result for SHA-256 0aeb2e32b9f86637…

MALICIOUS

PDF

82.5 KB Created: 2021-03-24 04:42:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f009f9ce73a8d9b97be219ab8af27412 SHA-1: b02e415ca257751e458366d475518c312d5be663 SHA-256: 0aeb2e32b9f86637b67f7505e08134cf04a11a73afe3f5ea5e59aca5a3bf890d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'https://resalured.ru/123?utm_term=ardaas+karan+2019+movie', which is likely used to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to a movie, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=ardaas+karan+2019+movie
    • https://cdn.sqhk.co/rosomugimo/Xhcm619/casino_card_game_faro.pdf
    • http://digitaloffice24.ru/vuvunabolevutaxexomuwj29la.pdf
    • https://cdn.sqhk.co/kifuzopeko/U7gehjc/mixoxusu.pdf
    • http://avtoshtorki.shop/merge_dragons_event_keys_froopy_flightgw5um.pdf
    • http://marafonsport.site/83608080157anq2w.pdf
    • http://vinograd.io/tozedudepunalezih9nvy.pdf
    • http://trikolor.site/article_analysis_example_apa_formatfqmtq.pdf
    • http://lemixebu.22web.org/layers_of_earth_s_atmosphere_worksheet.pdf
    • http://nakidki-alkantara.xyz/who_created_the_first_social_work_training_programujwh2.pdf
    • https://cdn.sqhk.co/mavozopofug/idkNcic/world_conqueror_3_conquest_tips.pdf
    • https://cdn.sqhk.co/logubaxe/gcMWgh5/rock_and_roll_music_online_radio.pdf
    • http://blu-ital.space/sccm_inventoried_software_reportc4qgv.pdf
    • http://trastenmyqort.online/213799198791tkm1.pdf
    • http://webomiwizux.22web.org/kojejuruvupolawiwejorak.pdf
    • https://cdn.sqhk.co/bikegola/2CigeKX/slingshot_ride_fails.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/varolexexus/bajazopesobasukoxo.pdf
    • https://uploads.strikinglycdn.com/files/95046335-6b06-4117-8c11-98e68d8daccb/sat_math_tips_and_tricks.pdf
    • https://s3.amazonaws.com/xipavir/cours_sur_les_accents.pdf
    • http://lukugebov.rf.gd/rigilufesusesixunamufo.pdf
    • https://uploads.strikinglycdn.com/files/516b2a2a-57c3-40a8-a4c6-1f9142c28a3d/2007_jeep_grand_cherokee_laredo_problems.pdf
    • https://uploads.strikinglycdn.com/files/05e49a15-cfae-4654-8486-193582c8b870/hamilton_beach_2_in_1_iron_steamer_reviews.pdf
    • https://uploads.strikinglycdn.com/files/0686299f-0ca2-475d-9a04-f361b486b4b4/79327680423.pdf
    • https://uploads.strikinglycdn.com/files/37266da7-d2e7-40b4-84a1-20787083ec93/52787450058.pdf
    • http://gawupuzilolo.epizy.com/tezabubejabijused.pdf
    • https://s3.amazonaws.com/lekelepowo/jowubas.pdf
    • http://tizesabukabel.rf.gd/practice_worksheet_graphing_square_root_functions_worksheet_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec62.bin
60cc6ebb0546d168bf267cfb0e7b8f31e3686197951d2ac5cc897ee70679488e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC62 5532 bytes
font_01_sfnt_off0000ff23.bin
a2506e861063078f110f487d7d6e2f890ba3a47635055bb8e4ef696503365417		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF23 11636 bytes
font_02_sfnt_off0001272d.bin
c41fc46809d2260d2d1a821cef6bb00dae560fdbad380da94a93f29d012df54e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1272D 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.