Malicious PDF — malware analysis report

Static analysis result for SHA-256 61eb99556d010287…

MALICIOUS

PDF

83.7 KB Created: 2021-04-02 19:42:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: becce569605359b98f0af72a6c7b2c14 SHA-1: 58f9999093411b7f2ae90672b65df67c09686d00 SHA-256: 61eb99556d01028753b0f827a4c95aa91f0280357b8eaa61230036898f90291e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a mass external link farm, with one prominent URL pointing to a suspicious domain ('resalured.ru') that is likely part of a phishing or scam operation. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan. Although no scripts were explicitly extracted, the PDF structure and heuristics suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+move+a+nordictrack
    • https://cdn-cms.f-static.net/uploads/4459320/normal_603b9ba6597ae.pdf
    • https://cdn-cms.f-static.net/uploads/4418556/normal_5fd913afc0d55.pdf
    • https://cdn-cms.f-static.net/uploads/4380088/normal_60622fee68b8b.pdf
    • http://butixizofim.22web.org/dnd_5e_descent_into_avernus_free.pdf
    • http://walafim.22web.org/34917130218.pdf
    • https://cdn-cms.f-static.net/uploads/4382613/normal_6016b435c8fca.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://9539e3d7-93ad-434a-85ac-22bd9bdb82bb.filesusr.com/ugd/df7b34_87d705cb84484b5c9454a2b76aea524f.pdf?index=true
    • http://redowana.epizy.com/red_ball_4_games_apk.pdf
    • https://uploads.strikinglycdn.com/files/e168eda0-7368-4139-b3b3-bbe13fc511f7/1507140136.pdf
    • https://uploads.strikinglycdn.com/files/56096cd2-5e97-441c-b285-309c4f731b9f/vufusirozagof.pdf
    • https://51bf459c-6b46-41b0-863f-532cf8a77e0d.filesusr.com/ugd/2eedf1_f919075c146045ec95d15b9b2d107060.pdf?index=true
    • https://s3.amazonaws.com/jivamubug/predicas_cuando_lo_que_dios_hace_no_tiene_sentido.pdf
    • https://a6053a4b-6066-498d-92a8-7748b68531bc.filesusr.com/ugd/5f0d2f_ace6605fa31643678c4b65db54eee4cc.pdf?index=true
    • http://damugiwixosaxo.epizy.com/xukezedogiripukonajoras.pdf
    • https://uploads.strikinglycdn.com/files/545c616d-7284-4c4e-88ce-8cbdd89ba4a4/6256148920.pdf
    • https://s3.amazonaws.com/jukoxisojow/borderless_gaming_8._4_free.pdf
    • https://48cc712b-de5e-493e-a198-f8962849e22b.filesusr.com/ugd/d2751c_60ed7024b71f488da6dc891ea083bd75.pdf?index=true
    • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_ed83fd5deabb476fb2951121844fa33f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f09cd965-e87f-4229-ac38-f4650b911454/ice_cream_machine_reviews_south_africa.pdf
    • https://aaf2f8d8-4593-4070-95c3-ed2308805076.filesusr.com/ugd/337eea_5e1887dba7f540178ec4de56e9db8d3a.pdf?index=true
    • https://6a9ecc2b-05c3-4056-8705-773ae6be8cdd.filesusr.com/ugd/7a359d_afaf82f92dc1463abff4fb520362482c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f340.bin
4db14046470a4a556e932324e92f6db3fff1c3921a5d158853574e06b1c6609c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF340 5052 bytes
font_01_sfnt_off00010462.bin
da7c53c6cfbb1b18b66a08fabf2a2aed8554f542f400e30e6b7f5ad2d79b0dd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10462 7644 bytes
font_02_sfnt_off00011908.bin
b85f2a64362943951d14cd5acaeac90041ec168fbe032581d98b5438cbd4be69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11908 11336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.