Malicious PDF — malware analysis report

Static analysis result for SHA-256 4540a53b007462eb…

MALICIOUS

PDF

81.1 KB Created: 2021-04-05 22:30:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7de28f559658ff1573d719a8ce0b19af SHA-1: e832c9e016097b25a46b6b1dac61f0c040ff8ab6 SHA-256: 4540a53b007462eb9c6ec5533cb9888780b120af603a2122dbe832963b791ec8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'resalured.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a technical topic ('Current transformer secondary voltage calculation') to lure victims. No scripts were extracted, but the presence of multiple PDF_URI and EMBEDDED_URL heuristics strongly suggests the document's primary function is to redirect the user to a malicious external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=current+transformer+secondary+voltage+calculation
    • https://cdn.sqhk.co/jiluputumusi/iVlhahj/tawix.pdf
    • https://cdn-cms.f-static.net/uploads/4391001/normal_60642329784f9.pdf
    • https://cdn-cms.f-static.net/uploads/4461511/normal_606949d91aae4.pdf
    • https://kunasituper.weebly.com/uploads/1/3/4/7/134765547/guwefebesiledovasa.pdf
    • https://cdn.sqhk.co/dixufeja/aV05gho/xogelefefofenig.pdf
    • https://static.s123-cdn-static.com/uploads/4501482/normal_6009a1102d3b6.pdf
    • https://static.s123-cdn-static.com/uploads/4420743/normal_5ff1d2d75c212.pdf
    • https://dapobatajixafaw.weebly.com/uploads/1/3/4/3/134310280/dotuv.pdf
    • https://static.s123-cdn-static.com/uploads/4369909/normal_5fe2ca66932e8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ddb1515c-011f-4d6c-9a6c-b305a2039a85.filesusr.com/ugd/477ac5_07861f2d44124bc296ba7c16db2fe5b1.pdf?index=true
    • https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_2996d1cf227a43899e92590c87e0c4bf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/075898eb-b0a7-4cac-a24f-de4ac89acb0e/tabozaxenavimeb.pdf
    • https://uploads.strikinglycdn.com/files/a49e8afa-318c-4cdb-8065-e8bb2e51f89d/honda_rancher_350_wont_shift_gears.pdf
    • https://411be8f8-4ba1-40b5-9edf-cc4a2c3d5ecc.filesusr.com/ugd/a86d68_111ea66264f44f52bf8131dc6f4f06a2.pdf?index=true
    • https://2aa89031-56ac-4de1-b828-aabe99840ec8.filesusr.com/ugd/cf14a4_6d4e1d706b124b02ade8cbd46b725517.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ac4b55bb-dbe1-45a6-9127-50d55fae60e0/88361299484.pdf
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_499a1c08033541989da191cebccffd3b.pdf?index=true
    • https://45e41439-46a4-4c97-84f0-155cfeda4cef.filesusr.com/ugd/9d7ad9_e7ccd481c2164e18ae340526460b1109.pdf?index=true
    • https://aaa8450b-5959-4376-bf95-5e5e4b45aab3.filesusr.com/ugd/bcfc74_95e837d30a9248ed9c701c2279b10ce1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fede.bin
1970e01485c776ff059bc4a0b044c547c3089de91fe58a22809816fd4407c422		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEDE 5408 bytes
font_01_sfnt_off00011139.bin
99d54fb624c39144794c05759af646cf99e39aa70917fc6581041b58e5e228a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11139 11028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.