Malicious PDF — malware analysis report

Static analysis result for SHA-256 879cc13432fb6da0…

MALICIOUS

PDF

131.2 KB Created: 2021-03-11 20:24:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2d043ac27214dd92e0c67067d21ce8af SHA-1: 99c2685fbe966bec3d63aba442d31354f8049731 SHA-256: 879cc13432fb6da0a0da98fbecb063eaa048a398fd21f8972026a2e3abc120ef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, 'resalured.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to medical treatment, intended to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=sindrome+anemico+tratamiento+pdf
    • https://cdn.sqhk.co/jarixizotib/ebWfJO9/33618824212.pdf
    • http://zeboxagekej.sportsontheweb.net/4._what_are_three_kinds_of_figurative_language_that_make_comparisons.pdf
    • http://vijexibat.mywebcommunity.org/kuvametopegavo.pdf
    • http://widonatozeg.mypressonline.com/converter_para_musicxml_online.pdf
    • http://gimemuwet.mypressonline.com/72487815987.pdf
    • https://cdn.sqhk.co/perukinabe/hiahjZM/16079488146.pdf
    • http://sevezor.scienceontheweb.net/jovimosubexudedixawo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/10853ffe-2c60-4140-a111-f78c5fbd807b/ditupuwijiwukigew.pdf
    • https://uploads.strikinglycdn.com/files/f1a2e237-a597-4af7-aa64-4e7915a23593/97085001655.pdf
    • http://kosezofejesuxef.atwebpages.com/posidig.pdf
    • http://bukezodebas.onlinewebshop.net/wonunatujibejivon.pdf
    • https://91c7bc9f-df77-4dbd-ae51-8bcf521f3e61.filesusr.com/ugd/1df9ea_28f39592a2244470aa9cd859f175b370.pdf?index=true
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_cdd6abc99ad04ccebd38a9dee6c4524e.pdf?index=true
    • https://e1ca4115-fb55-43f9-84f1-eaf814f8c83f.filesusr.com/ugd/18122d_b5065b8924774b2b948229ff8e1eed47.pdf?index=true
    • http://vekamodadon.onlinewebshop.net/applied_linguistics_download.pdf
    • https://30d6ba4c-d201-4e26-8f31-a0e059b28788.filesusr.com/ugd/f9b8bb_32f232a5995940daa044f1ae8c9b8d63.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d831ef2d-550f-4551-8413-78fb378aa788/letter_from_a_birmingham_jail_full_audio.pdf
    • https://uploads.strikinglycdn.com/files/053c7d9a-8626-4f1e-997e-9668606b3625/partial_differential_equations_for_scientists_and_engineers_farlow.pdf
    • http://fadudenomo.onlinewebshop.net/how_to_put_pictures_on_philips_digital_photo_frame.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001c568.bin
b1dcbca5e0d87b887af751895cd4f91237082263d2752d00564064c937d352b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C568 5192 bytes
font_01_sfnt_off0001d6fd.bin
ead1d188a9b37ff38c0be9cd91bbd07928bf16562ff31c9eaa83f7ce86bbb3e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D6FD 11800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.