Malicious PDF — malware analysis report

Static analysis result for SHA-256 83eb8bc098b72d0b…

MALICIOUS

PDF

68.3 KB Created: 2021-04-10 14:24:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 20138be45d1e3134c6095fdb43cb29cc SHA-1: f5ccd6603169d8fd4e1c5ea470a541822aba131e SHA-256: 83eb8bc098b72d0b7bfccff1ab2cfd4f533c16fc1f22db7f94bd21430b10b9ce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'resalured.ru', which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to product usage, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+use+starfrit+scale PDF link annotation
    • http://nejevefivi.mypressonline.com/what_are_the_purposes_of_social_work.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455194/normal_60268829a8394.pdfIn PDF document text
    • https://vixawesomuwevu.weebly.com/uploads/1/3/5/3/135387162/tirixo-tefiz-poxekunonipiv-kirer.pdfIn PDF document text
    • https://cdn.sqhk.co/vozevadijut/hgydnjj/the_walking_zombie_2_zombie_shooter_apk_obb.pdfIn PDF document text
    • https://cdn.sqhk.co/fowurona/jhb3jj3/90680937975.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464869/normal_5fd33c7fcdb6f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415950/normal_5ffac61cde63c.pdfIn PDF document text
    • https://cdn.sqhk.co/gavonenegave/hb44JKC/spongebob_color_fill_puzzle_game.pdfIn PDF document text
    • https://newosupileseru.weebly.com/uploads/1/3/2/3/132303396/1397054.pdfIn PDF document text
    • http://dusibarupuguli.medianewsonline.com/mapa_metro_praha.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vabedafozo/b_letter_images_in_heart_hd.pdfIn PDF document text
    • http://dowuvoduwitovos.atwebpages.com/hisaye_yamamoto_seventeen_syllables.pdfIn PDF document text
    • https://s3.amazonaws.com/kijelopazekune/98489328850.pdfIn PDF document text
    • http://duvodix.myartsonline.com/the_purpose_of_writing_a_personal_narrative_is.pdfIn PDF document text
    • https://s3.amazonaws.com/kulinisokakewi/arch_linux_python_development_environment.pdfIn PDF document text
    • https://9610c43f-1b2a-4a8a-b660-75aaf3908198.filesusr.com/ugd/286fb8_538c59c8e5ca48fb92dfe91ad1f5bdfb.pdf?index=trueIn PDF document text
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_a65bee0dbe5e4667a9edcb9f00e3668d.pdf?index=trueIn PDF document text
    • https://780c8f77-0f51-49ab-8dd1-60a90eb210a4.filesusr.com/ugd/1b8612_4ac6835dd84a46079ed5acab8931c607.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rujabepifar/42393539564.pdfIn PDF document text
    • https://s3.amazonaws.com/miwolezedubujoz/vebadora.pdfIn PDF document text
    • https://937a8a2d-b41a-4163-aff8-eda6db263557.filesusr.com/ugd/21e6f2_91d75dacebaa499a982c0a44c5b8e84a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d07b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD07B 4928 bytes
SHA-256: 2dba0fef9488a9841bb9d43d380ec0008ac23a39fb92500bd8cb8d81f6a8a783
font_01_sfnt_off0000e15c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE15C 10180 bytes
SHA-256: b5b739756a48e84f39cf5530c5f9723ebfab0de4bf27cee233da715af0bc7280

Open this report in the interactive analyzer, or submit your own file for analysis.