Malicious PDF — malware analysis report

Static analysis result for SHA-256 39bb4980d8112638…

MALICIOUS

PDF

116.1 KB Created: 2021-03-03 06:02:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d2c990f427c83e00ff68eb570e82634 SHA-1: 930147965e3df65c413b4c9d3c0985f910615fe2 SHA-256: 39bb4980d8112638b25ac432719aaa1b0c93159dd4027f2d383e4c85df6f5d16
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. The 'SE_ENABLE_LURE' heuristic indicates the document likely contains instructions to enable macros or editing, a common tactic for malware droppers. The embedded URL 'https://resalured.ru/123?utm_term=arcane+power+trinket+macro+vanilla' is a strong indicator of a phishing or malware distribution attempt. While no scripts were directly extracted, the PDF structure and embedded URLs suggest it's designed to exploit vulnerabilities or trick users into executing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=arcane+power+trinket+macro+vanilla
    • http://bbbbbbbbeeee.space/125895760gvlk7.pdf
    • https://cdn-cms.f-static.net/uploads/4386597/normal_602e30213344a.pdf
    • http://wamuwosola.mygamesonline.org/12740500046.pdf
    • https://cdn.sqhk.co/lifudidu/hbwgijh/16423101322.pdf
    • http://baltika-trans.ru/powesuzepuloxedaxobewu43mgk.pdf
    • http://vubitim.sportsontheweb.net/85501027603.pdf
    • http://katipef.medianewsonline.com/bostitch_roofing_nailer_manual.pdf
    • http://gloslides.com/asra_guidelines_heparin_neuraxial1g40x.pdf
    • https://cdn.sqhk.co/xalazuwumi/FMjijjx/55231340537.pdf
    • https://static.s123-cdn-static.com/uploads/4408701/normal_5ff1832e648ca.pdf
    • http://fojukivijivik.medianewsonline.com/how_to_read_a_neptune_t-10_water_meter.pdf
    • https://cdn-cms.f-static.net/uploads/4382773/normal_602164e7cb0f3.pdf
    • https://cdn.sqhk.co/rutesawir/IjcRtvX/top_100_bollywood_songs_2019_2016.pdf
    • http://sibatike.getenjoyment.net/why_is_navy_seal_training_so_hard.pdf
    • http://luxasireku.sportsontheweb.net/81385633889.pdf
    • http://cabinetshq.xyz/ipad_guided_access_forgotten_passwordcf30h.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bodegifu.atwebpages.com/xiruturodobonix.pdf
    • https://s3.amazonaws.com/lijulijowivaze/88755769135.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017b64.bin
d826c848e655ff34f25847aee3b9c1c4edffc2ac45964f64f07d313d79021994		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17B64 4892 bytes
font_01_sfnt_off00018bef.bin
dbca3f8ff0f58810eef5aef501effaaddbcaf71194bf4784d7b2b4d07c3b1943		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18BEF 11864 bytes
font_02_sfnt_off0001b45a.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B45A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.