Malicious PDF — malware analysis report

Static analysis result for SHA-256 22dcaea418993224…

MALICIOUS

PDF

76.1 KB Created: 2021-04-28 18:16:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 316b64af5fba9e2dcfa64838defc2c0c SHA-1: 603b36398c65a6219261fd5a3bbe14f921eace07 SHA-256: 22dcaea4189932241589b9d66e1f0cbc34c3a2d5b5938cac5dcb7d178e5ea0cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, 'https://resalured.ru/strik?utm_term=whirlpool+washing+machine+service+in+coimbatore', suggests a phishing or social engineering lure, disguised as a service advertisement to trick users into clicking it. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs are common in phishing documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=whirlpool+washing+machine+service+in+coimbatore
    • https://cdn.sqhk.co/lazujanaziri/bhbwgc2/51135121706.pdf
    • https://zokuvulasaxibu.weebly.com/uploads/1/3/5/2/135298812/f3fc9e0b930c19b.pdf
    • http://sunigol.22web.org/29847207646.pdf
    • https://cdn.sqhk.co/livulopo/gwgeOje/zgirls_2_last_one_mod_menu.pdf
    • https://mafukizagodixep.weebly.com/uploads/1/3/4/5/134525221/560795d6d44514.pdf
    • https://kutufesivom.weebly.com/uploads/1/3/4/6/134632784/9007918.pdf
    • https://sakiverore.weebly.com/uploads/1/3/6/0/136095660/9267db4b6264.pdf
    • https://cdn.sqhk.co/kasavakujosi/tjdgegj/the_castles_of_burgundy_with_expansions_2019.pdf
    • https://cdn.sqhk.co/nokulebepoba/nDS7tKT/facts_about_periodic_table.pdf
    • https://cdn.sqhk.co/jirudumom/h8haThg/digi_unlimited_high_speed_internet_1_hour.pdf
    • https://cdn.sqhk.co/wugeguxu/trmcBhf/48754786816.pdf
    • https://cdn.sqhk.co/noxisoture/5HvjgHZ/second_galaxy_corp_guide.pdf
    • https://pizopivawot.weebly.com/uploads/1/3/5/3/135347149/forimilo_jepefoliz_nurogodan.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/goveruduzewoxu/how_long_to_prepare_for_gre_test.pdf
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_a47e2df626ea4eda8550f653729181b0.pdf?index=true
    • https://s3.amazonaws.com/fowikorejodi/nakiwejuxurenupok.pdf
    • http://mudozegiviw.epizy.com/balis.pdf
    • https://a3c35cc3-4a3f-4d41-ab51-8b3e4b114d30.filesusr.com/ugd/2b25b5_1cee00ff3ca14cbf9d31300dc250e953.pdf?index=true
    • https://s3.amazonaws.com/jojitagifuva/welopovotabapa.pdf
    • https://12350a4d-732a-4148-85a7-4fa27f2a77ec.filesusr.com/ugd/17beed_6b4334ed29de4b01ac08c7a793ad7a67.pdf?index=true
    • https://b998fa74-583e-446a-a2a7-67f41460fdb2.filesusr.com/ugd/e081f8_34e9e1f119f54ab895f17509dc80e4c5.pdf?index=true
    • http://tegazadolital.rf.gd/kulodogenobiwanobaluger.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e85b.bin
df9e8629d594bca0940f210695c5725af0f64be20550a8f678c08ec1e8ba5b36		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE85B 5652 bytes
font_01_sfnt_off0000fb81.bin
7f195d9e2da24ffb8b621a15ec669d9060cc6a46f8f6dd5fdf1078a8f7067f94		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB81 11004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.