Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e862dba8dcd5253…

MALICIOUS

PDF

76.3 KB Created: 2021-05-29 04:04:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: fd4a92ad4ef32111664cd0f8449473d0 SHA-1: dd642c7a0c03a61cca25e54d14ff198b3313b2a0 SHA-256: 3e862dba8dcd525312702fbd6a57958671440185f3874f4130cf619c86af8dfc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, 'resalured.ru', which is likely used to host a phishing page or distribute further malware. The document body, though partially corrupted, contains text related to continent characteristics, suggesting a lure to attract unsuspecting users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=caracteristicas+de+los+continentes+africa PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4387421/normal_60051299cd18c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369182/normal_5ff89b6eec3a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448536/normal_60297ef09e84b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373778/normal_60454ecd3ebb3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4463809/normal_5ffdd36d57e9c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450048/normal_5fda0bb87180f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448735/normal_60077cc00db50.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382192/normal_6065e9a846760.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417817/normal_6063d3712e108.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421477/normal_601b8f65d0207.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501654/normal_5fcecb4b262c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412378/normal_603a01cdf176d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368468/normal_605951a476c92.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496402/normal_6042445a6d230.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392860/normal_5febef5178818.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368748/normal_606542c7d010e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443610/normal_6043eed96dba2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/13cff55a-974d-42a6-bea1-e073d0b98d8b/clash_of_clans_hack_version_unlimited_troops_apk_download_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2707851a-f538-416c-ad46-df90cd49a342/how_to_reset_service_due_soon_on_2012_honda_civic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54ab773c-591b-460f-bb31-a7cc32b97bf2/33721965319.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78f5a91b-c9a8-426d-a536-2e7a059679ad/how_to_transfer_call_using_nec_phone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef450ac8-5341-4b33-bec8-351d79df1ea1/what_are_some_limiting_factors_that_affect_carrying_capacity.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a1a3cd2-e745-4dd5-aa54-32aee834926b/fofawubovibaguxuzaxubuwax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f65fc4b-67a2-41c3-9562-cfb0923a2a64/photoshop_windows_10_software_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE75 4920 bytes
SHA-256: 78e4d246c6660280579d21b7420302b370cb2b589bb16e5a8de0e1df3f7caaa8
font_01_sfnt_off0000ff36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF36 10584 bytes
SHA-256: af2b0f781eed8cd81b1948b86223533ed0e7998bffb94311849658313044c7a3

Open this report in the interactive analyzer, or submit your own file for analysis.