Malicious PDF — malware analysis report

Static analysis result for SHA-256 34135692e4fae119…

MALICIOUS

PDF

82.9 KB Created: 2021-04-07 03:01:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c2ed60264070b3dbf81cfdf3ac1e69a9 SHA-1: e9325e90590b9d1297ebc6c522e5903b9151f82a SHA-256: 34135692e4fae119e7314e5e41ab18d254a5776afeb6c741424798235ce9003c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'resalured.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to 'happy birthday piano hard pdf'. No scripts were extracted, but the presence of external URIs and the malicious verdict strongly indicate a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=happy+birthday+piano+hard+pdf
    • https://cdn-cms.f-static.net/uploads/4449618/normal_603712f0e3d3e.pdf
    • https://cdn.sqhk.co/benanejufa/Kjdjfgf/smash_2019_model.pdf
    • https://cdn-cms.f-static.net/uploads/4414848/normal_6065062622719.pdf
    • http://future-techno.ru/rae_es_diccionario_panhispanico_de_dudas_appendices_abreviaturashdfbp.pdf
    • http://small-italy.space/gekanetugekexerujelitup3dmsw.pdf
    • https://cdn.sqhk.co/zedozomi/jhij0hf/27554172939.pdf
    • https://cdn.sqhk.co/gagupibi/Vg9ieUQ/vojuzuwuduwu.pdf
    • http://jakartapro.xyz/kekinimutuwefunadjao.pdf
    • https://cdn.sqhk.co/rekewuneboxu/FN6idjd/964270585.pdf
    • http://wonder-ita.space/cen_tech_obd2_scanner_60794_update6a3zb.pdf
    • https://cdn-cms.f-static.net/uploads/4425921/normal_600badbc29e5d.pdf
    • https://cdn.sqhk.co/vusutesilo/igG1Jje/average_calculator_with_sig_figs.pdf
    • https://cdn-cms.f-static.net/uploads/4463306/normal_5fe610fe73342.pdf
    • https://static.s123-cdn-static.com/uploads/4486042/normal_6004ce2d7fbbe.pdf
    • https://cdn.sqhk.co/vasozaponem/jbNKOeH/cat_professional_jump_starter_compressor_cj1000cp.pdf
    • https://cdn.sqhk.co/pisimebuziz/ihfhjij/nivebajowomoduzimivinoxo.pdf
    • http://consumer-data-protection-bureau.com/cyanogenmod_gt-_i9060t79bp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f4dd034e-00c7-465c-b850-fb2d75accad5.filesusr.com/ugd/769f78_89fb493399f94b43ac24f59f72007ead.pdf?index=true
    • https://c8019651-2137-4367-b38e-775fff3f8a75.filesusr.com/ugd/fc5a02_0e99e322d7754eb8bbd596e24c0b9af2.pdf?index=true
    • https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_e771b337cba84ce684ca8853663229fd.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102d6.bin
9188d0f57a6c445ee9d7cf26d99de43ef0f7cded91fe5c620c718f0e8317a1a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102D6 5124 bytes
font_01_sfnt_off0001143a.bin
b42ee06dcd4b64221fb7a6e7b0dd1f92239e4a3cefd7df373e1abbbb82b51be8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1143A 12232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.