Malicious PDF — malware analysis report

Static analysis result for SHA-256 90ab71146f246f2c…

MALICIOUS

PDF

81.0 KB Created: 2021-04-07 02:58:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e43ebf4ddb53d45efe0df3ff671a9210 SHA-1: a2a0f876400332ac0504d593d43e97109e817def SHA-256: 90ab71146f246f2c524c839ec5e7977dc6752da3b8bd043bd0682858dc33f75b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains multiple embedded URLs, with the primary one being 'https://resalured.ru/123?utm_term=satin+sheets+target+au', suggesting a phishing or malware distribution attempt. The presence of PDF-specific heuristics further supports its role as a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=satin+sheets+target+au
    • https://cdn.sqhk.co/lomasamube/hcIiaT5/punobigixag.pdf
    • http://gravkamen.ru/rotten_tomatoes_best_movies_2019_audience_scored39n2.pdf
    • https://cdn.sqhk.co/maxegugej/Pdh2jbE/bike_racing_3d_apkpure_download.pdf
    • http://bbcua.site/common_and_proper_nouns_worksheet_year_2mmbpt.pdf
    • https://cdn.sqhk.co/zufuxirap/hhUFjcT/gonuruputaran.pdf
    • http://edayafar.xyz/jotul_f_602_eco_review9mjn2.pdf
    • http://baltika-trans.ru/19285661102gs1kc.pdf
    • http://winoorama.site/how_to_put_in_a_singer_bobbin_caselt1fl.pdf
    • https://cdn-cms.f-static.net/uploads/4481055/normal_5fdbfa73d5c4d.pdf
    • https://static.s123-cdn-static.com/uploads/4372382/normal_5ff9ea1f41e0e.pdf
    • http://dnepr24.info/zugerw4k23.pdf
    • http://leyloften.online/how_to_do_fractions_on_a_casio_fx_260_solar_calculatorl5n0u.pdf
    • http://metazoaapc.fun/482521593777f7bt.pdf
    • https://cdn-cms.f-static.net/uploads/4482208/normal_604a407d46688.pdf
    • https://cdn-cms.f-static.net/uploads/4426407/normal_5fda0c91803e8.pdf
    • http://auth02mobility.com/80772048479dp03h.pdf
    • http://classkaod.ru/how_to_change_date_on_g_shock_ga_110cevnt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gudagugagazof.rf.gd/74082951121.pdf
    • https://def26600-86c9-4442-a738-094ddf2992d1.filesusr.com/ugd/eb5a6a_3bcbcdd2998348bea3594ad53cd717d0.pdf?index=true
    • http://rigitusavogu.epizy.com/35643856299.pdf
    • https://34e51215-b586-4e01-b3ea-a219475a7b91.filesusr.com/ugd/46481b_b7e792df76764b7f9e41ba8f71eba7c9.pdf?index=true
    • https://e055bcc9-c4f1-4c6c-8dcb-0912bf54750f.filesusr.com/ugd/b4a829_786db83f6f5248b9b5e02ec9dec29bf0.pdf?index=true
    • https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_12a52d8ea9254eee8d113f90f85a5c10.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010082.bin
87429ef327fb203766c86b9f4ae8a7f2be52d6dd4955f04ef50853e4d138c7bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10082 5016 bytes
font_01_sfnt_off00011188.bin
dfdd15c1725a181906bb2ce949ec1a1b80aaa6f22c5ca66b16a212a0c72fe6f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11188 10496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.