Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ad5fc1c08fe2fe1…

MALICIOUS

PDF

90.7 KB Created: 2021-03-24 21:59:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: be4dff1d059a9db12778460408aa186f SHA-1: b8a8df8b4790ccb5838348d8611f02469ddfa498 SHA-256: 6ad5fc1c08fe2fe1fadd0031364c413d03fe5f2d688ea8c35cc1e90e00ec7c59
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. The presence of an embedded URI pointing to 'resalured.ru' suggests the document is designed to redirect users to a malicious site, likely for downloading further malware. The heuristic for a visual download button further supports the phishing or social engineering aspect of the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=gangstar+vegas+apk+download+highly+compressed
    • https://static.s123-cdn-static.com/uploads/4484994/normal_5ff1d0f16935f.pdf
    • https://static.s123-cdn-static.com/uploads/4412164/normal_5ffd5518b21e0.pdf
    • https://static.s123-cdn-static.com/uploads/4393644/normal_5ff189db02359.pdf
    • https://static.s123-cdn-static.com/uploads/4483336/normal_5ff8a0050fa99.pdf
    • http://usesoda.pro/27748141328eead.pdf
    • https://static.s123-cdn-static.com/uploads/4379844/normal_6009029069089.pdf
    • http://zejijinaw.iblogger.org/24076747137.pdf
    • https://cdn-cms.f-static.net/uploads/4384817/normal_603203d001f03.pdf
    • http://5coupon.info/wodogizufupdk0o.pdf
    • http://bbcua.site/92078454707761t3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://dinorafox.epizy.com/76127104430.pdf
    • https://s3.amazonaws.com/jiwisi/32604709975.pdf
    • http://takoxiwewol.epizy.com/judefowididagewijog.pdf
    • https://uploads.strikinglycdn.com/files/9edb52b3-1f7d-4e57-b9ec-bf0dab7f789d/how_to_structure_a_dd_campaign.pdf
    • https://s3.amazonaws.com/sajezife/mini_dvi_to_hdmi_cable.pdf
    • https://s3.amazonaws.com/zosevid/90700064999.pdf
    • https://uploads.strikinglycdn.com/files/1bb07490-671c-4e14-94da-3f2dad19558e/6-2_practice_tests_for_parallelograms_answers.pdf
    • http://janalusexisowa.epizy.com/free_inventory_template_google_sheets.pdf
    • http://rixadobi.rf.gd/10128186293.pdf
    • https://s3.amazonaws.com/bulujono/zufopazarixa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec6e.bin
6c6e5601e9d68fe3d4432613ea2712c9338d9181dae8b1500e6c58938865e501		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6E 5624 bytes
font_01_sfnt_off0000ff78.bin
696cb00d4ab94bb4e4bb145504d15d3651ae9d7f956f587fd670baaa88c3a021		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF78 5552 bytes
font_02_sfnt_off00010f6f.bin
289b2c3d37d567e913a954527a89cea3bc365e29396126cb72e2e11eb94906a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F6F 12100 bytes
font_03_sfnt_off00013730.bin
702db90d42636ecfbb1414188bfcce8466f506840e16ce24213d65cd16988d67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13730 16752 bytes
font_04_sfnt_off00014e46.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14E46 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.