Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ddf9c0d3f78552a…

MALICIOUS

PDF

84.4 KB Created: 2021-03-15 22:44:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 281b4ab99653bbd9777b125dbdb34ec6 SHA-1: ae8a47b41b36e707f00ab0a0943428a916e4af6e SHA-256: 2ddf9c0d3f78552ad6c470907322b0dd32d7ce721c7e6d1ad25d8eddf92b9672
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and ML classifiers, indicating a phishing or trojan threat. The PDF contains a large number of external links, many of which are likely part of a link farm designed to obscure the true malicious destination. The primary malicious URL identified is https://resalured.ru/strik, which is likely used to redirect users to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=employee+performance+review+template+pdf
    • https://cdn.sqhk.co/fubemabofof/cxgfkOo/kewozifawusutisepetezev.pdf
    • https://cdn.sqhk.co/xeloxilava/CbSghYg/cut_flower_growing_guide.pdf
    • https://weritudasokapo.weebly.com/uploads/1/3/4/4/134494226/2860061.pdf
    • https://cdn.sqhk.co/wisulekekij/q7ghg5H/bromatologia_carrera_informacion.pdf
    • https://widosutolitidaf.weebly.com/uploads/1/3/4/8/134847614/9302300.pdf
    • https://cdn.sqhk.co/buzulexoxuve/egivEk6/39227047281.pdf
    • https://navikeput.weebly.com/uploads/1/3/4/7/134755574/4830706.pdf
    • https://tatogupuragafa.weebly.com/uploads/1/3/4/0/134096405/a9ff486ef087598.pdf
    • https://xojajulu.weebly.com/uploads/1/3/1/3/131382271/lolezofelijat.pdf
    • https://cdn.sqhk.co/kinibemazoz/hj6jhjc/bobafovatumifixoga.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://71f68c9c-1037-483c-a0ca-f268b7ddd3c8.filesusr.com/ugd/87fdc7_47b11a41dffd45aab96537e212f509a7.pdf?index=true
    • https://35e1cc1d-5f6c-4a41-9b1b-b9ae8dddc97a.filesusr.com/ugd/351eee_745930f343f14749a60a5d73dab0312c.pdf?index=true
    • https://2ad55d82-15d9-4995-b72c-f03dca93b5f4.filesusr.com/ugd/11b7eb_d1c8c1fec29643b493ac5ceb78cc1775.pdf?index=true
    • https://34886cf3-15ed-44db-93e8-8979dc7c4cd7.filesusr.com/ugd/ea2c45_5d9be7b438114b99af4dedfd25bbf401.pdf?index=true
    • https://8860adff-7f0b-4cf3-a358-cdd560dff136.filesusr.com/ugd/625844_8e862c0bedca49e8989d88b4bc056dbc.pdf?index=true
    • https://692937ca-140d-46b9-9715-018e108c1018.filesusr.com/ugd/2540a5_386999854c494ccc9cf10003be5fe305.pdf?index=true
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_7fea76d6fbfc4abb8d692d157a56b48a.pdf?index=true
    • https://b20aee1f-b1b7-4e4e-be5e-d884e4ece670.filesusr.com/ugd/10e3af_7498d2a1b7f54cb0a24c38862a5014b3.pdf?index=true
    • https://08c3cc13-1ce0-4add-927e-a3aed263473e.filesusr.com/ugd/ccf397_46522928756549a3a8d7690015e956dc.pdf?index=true
    • http://falalovoxiwada.epizy.com/medical_embryology_textbook.pdf
    • http://tunufefenus.rf.gd/icewind_dale_2_custom_portrait_size.pdf
    • https://f8071fb1-33dc-4bb9-9fe9-292e0ca0d861.filesusr.com/ugd/253000_8269f1da9b6c41fb9a66bb50460c55ea.pdf?index=true
    • https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_4d759e3ba47b41cfa745a720807a8583.pdf?index=true
    • https://1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com/ugd/754d94_351f92e78d7a478199487863863c8974.pdf?index=true
    • https://e6343aec-df69-40e7-9959-3c0c55bf73c9.filesusr.com/ugd/6a9017_bf8667c7bce8465bbc02081c6227736b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c3e.bin
6487b7446f5eebaed43ceb1482624d648734164401e1dcc533c342af8e40fb31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C3E 5332 bytes
font_01_sfnt_off00011e6a.bin
51b9ee223ec4368bcb2889c579236f35844e06ec0e98d56a89abe6ebd55973d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E6A 10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.