Malicious PDF — malware analysis report

Static analysis result for SHA-256 0aee32b44bdec9ff…

MALICIOUS

PDF

58.2 KB Created: 2021-03-22 22:40:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a8baf76536456467026ff88bde88754 SHA-1: 0a420f40eeb4d769500fe23cc81751359f9ab7e4 SHA-256: 0aee32b44bdec9ffc3725a638baace28093456671b4da9e198a0e8f4ebd7bfc8
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a lure related to loading brads in a staple gun, which is highly suspicious given the file's malicious verdict. The primary heuristic firing indicates an external URI pointing to 'resalured.ru', which is likely the malicious payload delivery URL. ClamAV detection further confirms its malicious nature as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9120

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+load+brads+in+a+stanley+bostitch+staple+gun
    • https://cdn-cms.f-static.net/uploads/4476434/normal_605854ed3792e.pdf
    • https://pujuxuzanebov.weebly.com/uploads/1/3/5/3/135351243/3502627.pdf
    • https://robidolaw.weebly.com/uploads/1/3/0/7/130776002/4226815.pdf
    • https://cdn-cms.f-static.net/uploads/4452607/normal_605793c6e96f8.pdf
    • https://todisosoban.weebly.com/uploads/1/3/1/0/131070867/344a127811.pdf
    • https://lopamazaveseku.weebly.com/uploads/1/3/4/6/134643240/cb43f580ed5.pdf
    • https://sazulolako.weebly.com/uploads/1/3/1/4/131453808/2f77ff84523.pdf
    • https://static.s123-cdn-static.com/uploads/4459625/normal_5ff3257b9d2cc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_ba0a1f8040874f3e920b96a4d2d27473.pdf?index=true
    • http://nimobavaze.epizy.com/judukekilegidogux.pdf
    • http://lesigoviweti.epizy.com/zokokadopuveminalejuje.pdf
    • http://nixuverojezuluz.epizy.com/hand_operated_capsule_filling_machine.pdf
    • http://vulewibof.epizy.com/76964091011.pdf
    • http://kukadafimi.rf.gd/46680150213.pdf
    • http://kutoduno.rf.gd/90000881719.pdf
    • http://mutupoda.rf.gd/45769794872.pdf
    • https://a815f367-2516-4b88-9496-eed07d5c1eb7.filesusr.com/ugd/665c20_fe89a5dc5bc940ce98ee3e69b2576a04.pdf?index=true
    • http://lamupilabixekuw.epizy.com/bukimine.pdf
    • http://tibupud.epizy.com/vazoxenep.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2fc.bin
2fe052e5dc85549704b1262d530b820e9158f8139d9dc34f671b30eb69b44704		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2FC 5512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.