Malicious PDF — malware analysis report

Static analysis result for SHA-256 67cfe5f23d512f51…

MALICIOUS

PDF

88.1 KB Created: 2021-03-25 00:52:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 797bd15b7a80ba858fd1575e52b96e0d SHA-1: 22904c3583f040c4cb34619ffc250e7b321c51d7 SHA-256: 67cfe5f23d512f51b6589424fd2e14efb18b4d45fb28d3a6a7315802d969e6c0
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file was detected as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'SE_BROWSER_INSTALL_LURE' strongly suggests the document's purpose is to trick the user into installing a fake browser update or extension. An external URI pointing to 'resalured.ru' was extracted, likely serving as a download source for the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=sec+afs+cover+sheet+2019
    • https://cdn.sqhk.co/lidojuxuxiro/5sIifgc/japonibipulegejepadiro.pdf
    • https://cdn.sqhk.co/mivuxakadu/iihiEgj/juwipurotifivimadebuwopax.pdf
    • https://cdn.sqhk.co/puwipaneke/et1KAgj/old_time_arcade_near_me.pdf
    • https://cdn.sqhk.co/kominepoli/icPj2ji/24284012030.pdf
    • https://cdn.sqhk.co/pemanunid/Elic1Sb/installation_of_the_reporting_services_point_role.pdf
    • https://cdn-cms.f-static.net/uploads/4466166/normal_604b76fd12a84.pdf
    • https://cdn.sqhk.co/rozesivotix/ah5N2ig/super_fast_drift_trike.pdf
    • https://cdn-cms.f-static.net/uploads/4475196/normal_60378d8b93e13.pdf
    • https://cdn.sqhk.co/guwodirulik/hcRmthc/16614665533.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5e54d98c-4257-4cc7-9010-48f3df296eb2.filesusr.com/ugd/05240c_ab639c152b9d45d8ab208ff05410ba7e.pdf?index=true
    • https://4d75d3c9-3a4d-4df6-84ab-e48b83d723e5.filesusr.com/ugd/cdb50c_c2f3947514b147c9ba3e4df6fe360001.pdf?index=true
    • https://c2093f15-f4fb-4bda-9582-db5404103fa6.filesusr.com/ugd/b28561_acafd85efbe34df2a567fe2d2b98baf9.pdf?index=true
    • https://44879a12-c10a-431c-a98a-7de142752d0f.filesusr.com/ugd/bb4607_6614349f6e2649ed8bab27452af672ae.pdf?index=true
    • http://xivavop.rf.gd/what_are_the_official_rules_of_chess.pdf
    • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_5f446b5d47c24958b8cf7bb2c85bdf3e.pdf?index=true
    • https://fe4fa097-7109-4367-a76b-bc1f2b7936f3.filesusr.com/ugd/ef6f93_d2116ea780bc4e63b92a491c02a8b12b.pdf?index=true
    • https://e4dd5bf8-bd13-43e3-b37b-9624b2564f03.filesusr.com/ugd/093416_968d4e59750e41a9933ac745f5483c14.pdf?index=true
    • https://d17f4099-ecc1-42b1-9c73-51521793457c.filesusr.com/ugd/4a2613_d5d0aeb5727d467f9eb4487ed5b08970.pdf?index=true
    • http://lobidirubegevil.epizy.com/ashton_irwin_superbloom_cd_uk.pdf
    • https://94db4134-5784-44c5-a63d-963e509970fa.filesusr.com/ugd/9c58c5_9fedfff9a8564159a7460741311ecb19.pdf?index=true
    • http://josejutolaxof.rf.gd/86665340046.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa24.bin
913f57a51eb67ebb5d81eca050bb599724a287f9155f14131ed86c4d92830781		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA24 5580 bytes
font_01_sfnt_off00010d1c.bin
daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D1C 1800 bytes
font_02_sfnt_off000115aa.bin
01a487ee0cbc79bf788878eedfdaf59be83e91698f927d3d0ff45c481b478f21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115AA 11584 bytes
font_03_sfnt_off00013d79.bin
5bfda07072dd2e1b0df7f1680a75ba616774ec51e1a09c257f000ba239241e1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D79 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.