Malicious PDF — malware analysis report

Static analysis result for SHA-256 1abba16d206d2d41…

MALICIOUS

PDF

78.8 KB Created: 2021-03-14 20:21:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 042ac3a2d7f1fca13b53a96c2ebd0d48 SHA-1: 3801787facdee0e081f552f8259feb362675301d SHA-256: 1abba16d206d2d419a24e871a765c8fc369a28db0b3b75f2be99e6d1e418f8dc
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URIs, with a primary suspicious URL being 'https://resalured.ru/wix?keyword=the+martian+google+drive+hindi'. The document body, though heavily obfuscated, suggests a lure related to popular content, likely to trick users into visiting these malicious links. The presence of multiple disposable hosting links further supports a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=the+martian+google+drive+hindi
    • http://lirebuwoke.mygamesonline.org/46510630180.pdf
    • http://patajafurep.mywebcommunity.org/how_to_find_acceleration_due_to_gravity_at_different_altitudes.pdf
    • http://jedomagisuw.getenjoyment.net/acurite_wireless_indoor_outdoor_thermometer_manual.pdf
    • http://mirumumavetifun.mypressonline.com/81073560651.pdf
    • http://help-verification.com/calibre_50_contigo_mp3_descargar_gratisuf5w7.pdf
    • http://libopadu.scienceontheweb.net/billy_sims_bbq_menu.pdf
    • http://miiliioner.xyz/moleratewagazajulavufabu93zfl.pdf
    • http://rivozuzeno.mywebcommunity.org/90363730648.pdf
    • http://wunadimizurened.medianewsonline.com/dekizif.pdf
    • http://brumbum3.xyz/14643337184wxpvo.pdf
    • http://bukenisefino.mygamesonline.org/proposal_skripsi_akuntansi_manajemen.pdf
    • http://vodizurulenega.mypressonline.com/what_is_lc_and_its_procedure.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cf2e1f24-e5f1-4289-9567-3affce9c164e.filesusr.com/ugd/a4ea6c_76ad2a9d75884021b04021e3d6f998da.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e4178c3b-ff05-40fd-be71-eae3cfd77b26/xadujadavatufenibopumekof.pdf
    • https://29ca30ec-7ad4-487f-8637-d2d67f3a323c.filesusr.com/ugd/10b11f_32c04c825f43468684efddf911392bdb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/28af73c7-9cbd-49e7-8ad8-ee9eb2f0accf/wemawenovaxonazim.pdf
    • https://945b3f91-9c76-4178-be32-f0dab3cfe2c6.filesusr.com/ugd/8d5d69_8e7fa0840d4e4cc2ac033f5b6c95695e.pdf?index=true
    • https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_0df35d5c2b4143c5919c64efab57f8fd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bd6f24f4-2fdd-478b-9ef4-1021c12d7745/kizomareraguxulogomo.pdf
    • https://s3.amazonaws.com/punurum/employee_engagement_survey_communication_templates.pdf
    • https://s3.amazonaws.com/tawosutosuxi/xipexutapopok.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5b8.bin
d3c61c59a5ee71d56f055a22d4d13fa07d366a797fc4bf337b518d8c66df634d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5B8 5072 bytes
font_01_sfnt_off000106ca.bin
5005482e8743dbe606429f1041988f227e031113a218bc3c777f48571a4e9515		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106CA 10964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.