Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e64d257ef6c7034…

MALICIOUS

PDF

82.9 KB Created: 2021-04-08 05:21:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2bf68d49b93d935fe940a8947a6afe77 SHA-1: 775b930b080f06328103c3eaa5dffe7a1c6b13f8 SHA-256: 5e64d257ef6c7034aa8ec2ae7009504c9378e14ae145aaa39d4149257951314f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains strings that appear to be related to game guides, likely serving as a lure. The presence of an external URI pointing to 'resalured.ru' strongly suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=dissidia+opera+omnia+guide+reddit
    • https://cdn.sqhk.co/zurajekiviw/ij1jaig/call_of_sniper_final_war_mod_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4393499/normal_60175fc5942ac.pdf
    • http://alcozerox.com/tulirekiposomifebazmdg9x.pdf
    • https://cdn.sqhk.co/kitujesijak/hLiBC02/skee_ball_rolls_arcade_game_review.pdf
    • https://cdn.sqhk.co/fowizolomam/TfUVbgg/rilafezerativijufirozan.pdf
    • http://musofiron.ru/tom_clancy_jack_ryan_moviesjrs3q.pdf
    • http://creditstar-kabinet.com/551518818471wfpk.pdf
    • https://cdn.sqhk.co/mixaluwekitu/ciiMifV/affirmative_action_plan_components.pdf
    • http://trells.space/are_equate_meal_replacement_shakes_good_for_weight_losscqry7.pdf
    • https://cdn-cms.f-static.net/uploads/4446649/normal_6017b2877ac70.pdf
    • http://obzorov.site/itinerary_format_in_excelh5605.pdf
    • http://leftoutclub.com/jizibejakejonexud03tkp.pdf
    • http://hookup681.site/why_is_my_hp_envy_5020_printing_blank_pageseszl7.pdf
    • https://cdn-cms.f-static.net/uploads/4491925/normal_600b39dfa1819.pdf
    • http://generatorsale.ru/falasadezojikigav3w.pdf
    • http://lovewaits.ru/price_of_timex_indiglo_wr_30my12fh.pdf
    • http://guitar.su/nexamivojixejegafikc1x7l.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gomakobez/pumofopofelotawabate.pdf
    • https://s3.amazonaws.com/rutufokedizon/89953186196.pdf
    • https://9e2bb560-353e-4f5d-a08b-1363560edab4.filesusr.com/ugd/6c032c_fe2fd8730c0e41d89df350f732ff4d20.pdf?index=true
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_2f3b7d7c400e4d5eb6a10bdeece89491.pdf?index=true
    • https://41c240d9-b4af-4f88-8fa4-2a41cce3a287.filesusr.com/ugd/01bc73_88be518c3b4f4d1480b7e7b818f9bb7f.pdf?index=true
    • https://s3.amazonaws.com/mexavofezoxi/how_to_improve_your_listening_skills_in_the_workplace.pdf
    • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_ae5b5600430d41b59f959a72ecb10bc5.pdf?index=true
    • https://24d1f61b-f5c5-4d2f-8180-62589f44e8d8.filesusr.com/ugd/eed56f_594bb7afd7d94d879cbb291b0da8e97f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1bf.bin
cd0dfb756d2a0be8c775708c5e45e11cb8ca88503d390261c2ff92d01330880e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1BF 5244 bytes
font_01_sfnt_off00010385.bin
2b943bb197df3de4b9c961b63a3bfa28cf89eb84da46d3e2fb0e752bf3cf48d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10385 10896 bytes
font_02_sfnt_off000128fd.bin
c9557d91917e40dbb2ce09b7ef560a04a9a832ffe2ebcac6b50408a58351272e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128FD 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.