Malicious PDF — malware analysis report

Static analysis result for SHA-256 72920df3e6d7cfa4…

MALICIOUS

PDF

90.3 KB Created: 2021-03-21 05:47:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 633bf52cfc3ea4ff04aa6c08ff9244c1 SHA-1: 78b69c08f121a1a6a8e729e8c3fe43925303c326 SHA-256: 72920df3e6d7cfa4f6b8ff72991efa021b39599600e0da98140fc0d3266d6dc0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'resalured.ru', which is likely used to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a theme related to a 'Pravoslavni kalendar 2019 imena'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=pravoslavni+kalendar+2019+imena
    • https://cdn.sqhk.co/wibetaxor/je5alji/vupativuzesepuwo.pdf
    • https://cdn-cms.f-static.net/uploads/4454179/normal_60563a1856543.pdf
    • https://cdn.sqhk.co/milasutepi/heig4hg/2884977598.pdf
    • https://static.s123-cdn-static.com/uploads/4471096/normal_5ffba7ff88339.pdf
    • https://static.s123-cdn-static.com/uploads/4490001/normal_5fff20a0973dd.pdf
    • http://janafan.scienceontheweb.net/vastu_shastra_in_kannada.pdf
    • https://cdn-cms.f-static.net/uploads/4387233/normal_605253ce44a96.pdf
    • https://cdn.sqhk.co/winexajis/cIKvhjv/77749835165.pdf
    • https://static.s123-cdn-static.com/uploads/4426679/normal_5fca212ca3307.pdf
    • https://cdn.sqhk.co/fuvebopeweb/zWoohhd/vutigu.pdf
    • https://cdn-cms.f-static.net/uploads/4464056/normal_601dc0ba77d9b.pdf
    • https://cdn-cms.f-static.net/uploads/4409405/normal_5fe7fac3433c3.pdf
    • https://cdn.sqhk.co/zezetemirag/ggjahgK/8663751939.pdf
    • https://cdn-cms.f-static.net/uploads/4387040/normal_5fe7aa382b19e.pdf
    • https://cdn.sqhk.co/bikuwizatag/ideSEid/dagomupagenipa.pdf
    • https://cdn.sqhk.co/pisupuwov/gDHmKjj/gugevasigedodom.pdf
    • https://cdn-cms.f-static.net/uploads/4485310/normal_60206dfc1c150.pdf
    • https://cdn.sqhk.co/xupodafib/i4aihif/32401757456.pdf
    • https://cdn.sqhk.co/wubunepan/g3Rjb8a/75330018210.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b09aad7d-1305-43e6-b687-248080f2a736/zopivuso.pdf
    • http://fugufaza.myartsonline.com/42556676396.pdf
    • https://uploads.strikinglycdn.com/files/a3073850-b746-4ea7-ad02-1fb8e9f56eef/how_long_does_a_john_deere_lawn_mower_battery_last.pdf
    • https://uploads.strikinglycdn.com/files/993861a0-6d6a-4d77-8591-484dbf40b93f/nanostation_m2_loco_access_point.pdf
    • https://uploads.strikinglycdn.com/files/816d8a2a-a39e-4d52-8095-733a73e42e5c/ritetemp_6022_troubleshooting.pdf
    • http://lawaxisagiwog.atwebpages.com/wirijavejituviwibejeb.pdf
    • https://uploads.strikinglycdn.com/files/2dc6f568-f9f0-478a-b9e3-0f4cba4a0cda/how_to_think_positive_thoughts_in_a_relationship.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012302.bin
decaa2510e171482bae26635d54bd5e61e59f4c1518a2c962b4dee99575b2885		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12302 5580 bytes
font_01_sfnt_off000135e3.bin
dfebe917c022afa684c20141c3cfe0731e9310942a13f1fcb84acbaf347985ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135E3 11400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.