Malicious PDF — malware analysis report

Static analysis result for SHA-256 93e3404b781d3d46…

MALICIOUS

PDF

89.9 KB Created: 2021-04-08 16:03:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 2acdaa0306bb19851d6c538644d94575 SHA-1: a845637ffb7db3f8adc5f41ddf3c3daefe8cee82 SHA-256: 93e3404b781d3d46e7b4822293740f3f161ff5e8919dd67ab8fcba571b0c3075
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, https://resalured.ru/strik?utm_term=garmin+gpsmap+750+manual, is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to a Garmin GPSMAP 750 manual, consistent with a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=garmin+gpsmap+750+manual PDF link annotation
    • http://zisetevopazotaw.iblogger.org/nejolujorinupasu.pdfIn PDF document text
    • http://help-feedback-amzn6.xyz/casos_clinicos_de_parasitologia_resueltoszcua0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414156/normal_5fcdd3088c2b7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450641/normal_5ffac33bc0f28.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4423714/normal_5ff7f724e4d6d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455180/normal_5fcbb7fd4d746.pdfIn PDF document text
    • http://smartradiobf.ru/real_communication_an_introduction_4th_edition_online_freewk4p4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447630/normal_60330019dba67.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376354/normal_604539eccc7bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379387/normal_60367d4eefbd0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486041/normal_6005d28ee650d.pdfIn PDF document text
    • http://manybigs.space/how_to_reset_ge_wall_ovenfgxtr.pdfIn PDF document text
    • http://tohld.in/32915622187tikze.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://jujewejono.epizy.com/daripanonubevov.pdfIn PDF document text
    • http://bebubizaguwadef.rf.gd/yogasana_book_in_tamil.pdfIn PDF document text
    • https://f2203da8-4034-475c-a980-a37079f2cd7f.filesusr.com/ugd/d29026_c2e0d5310255462f821df87ee28cbc0e.pdf?index=trueIn PDF document text
    • https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_427ffe98c2294cf2a25cdbc073c440ed.pdf?index=trueIn PDF document text
    • https://ff743420-c5e2-4527-a456-70ddb2a1abd8.filesusr.com/ugd/5178f2_2767e339c98149578909b536f16f393f.pdf?index=trueIn PDF document text
    • http://zotijoxamofos.epizy.com/lozofixakemomoma.pdfIn PDF document text
    • http://karuserewojax.epizy.com/vasimipesimavike.pdfIn PDF document text
    • https://5de6e22f-064f-4859-b003-4eaa502c5056.filesusr.com/ugd/2609e6_2fabe9200f124b30b9ae84250294bd50.pdf?index=trueIn PDF document text
    • https://45b0b119-5f8c-43e7-b437-4e12d17c1c81.filesusr.com/ugd/3826db_ea440716294d49e48de8dbe9a9dce1ab.pdf?index=trueIn PDF document text
    • http://vesoromu.epizy.com/bhagam_bhag_songs_bestwap.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000121d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121D5 5516 bytes
SHA-256: dad849cd9861de379031f8cf94c14e1ca385dce5df595038153e59249d26a8f1
font_01_sfnt_off00013489.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13489 11224 bytes
SHA-256: 91ff8495f6aab2599cbba2670b1b1b9a9f1fe001722e086328501c31ae9623bb

Open this report in the interactive analyzer, or submit your own file for analysis.