Malicious PDF — malware analysis report

Static analysis result for SHA-256 99f5afd723b516d8…

MALICIOUS

PDF

77.6 KB Created: 2021-04-02 03:41:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 15fe1eed0a80a181836fb95cbf59df59 SHA-1: 2081dc6960e44045c27de9c6fe5c5f315f77f722 SHA-256: 99f5afd723b516d82d8c62d372ddae5e9485547743c54c63b1351eadcc44260d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ML classifiers and ClamAV as malicious. It contains an embedded URL pointing to 'resalured.ru', which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, contains text related to checking a 'tel line' and the wkhtmltopdf tool, suggesting a social engineering pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=what+does+it+mean+when+it+says+check+tel+line
    • https://static.s123-cdn-static.com/uploads/4369182/normal_5fec74e66f160.pdf
    • http://dunatizikasinab.22web.org/spirituality_of_the_cross_by_gene_veith.pdf
    • http://tamowigaxijatot.66ghz.com/china_embassy_visa_form_bangladesh.pdf
    • https://cdn-cms.f-static.net/uploads/4392191/normal_604ca07a7655d.pdf
    • https://cdn-cms.f-static.net/uploads/4426277/normal_606646dce6d19.pdf
    • http://judijemavup.22web.org/parquet_file_format_wiki.pdf
    • https://cdn-cms.f-static.net/uploads/4375891/normal_6043399651d69.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mivokozibu/16072292428.pdf
    • http://pibimosozo.rf.gd/jesasuwabudexo.pdf
    • http://ruwitubis.rf.gd/wild_animals_colouring_pages.pdf
    • https://s3.amazonaws.com/wurivuve/afro_soul_house.pdf
    • http://mebewoxesare.epizy.com/child_diagnostic_assessment_template.pdf
    • https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_1484076e65604bbf8b44d770fad996af.pdf?index=true
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_66afeefa081543c481fecb4ce13d164c.pdf?index=true
    • https://s3.amazonaws.com/nafoxuda/pexokav.pdf
    • https://5a6df620-610b-4d6f-8f1b-71e936bb70bc.filesusr.com/ugd/1f5cef_cf056319ad3844d592eb8519841b7651.pdf?index=true
    • http://zaponabugati.epizy.com/46993705098.pdf
    • https://s3.amazonaws.com/mudurixo/20204784314.pdf
    • https://7c3dd69e-6649-485e-b385-36acc2971cd6.filesusr.com/ugd/cf9ff1_3c23afcfa393416794237fa834abc46a.pdf?index=true
    • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_cf1ead9be79a41a1947e11361bd70b9b.pdf?index=true
    • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_52819bf404b446868261cd078bfa10c9.pdf?index=true
    • http://xikimafelote.epizy.com/catharanthus_roseus_chemical_constituents.pdf
    • http://wiwafejopof.epizy.com/blade_and_soul_assassin_guide_fr_2019.pdf
    • https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_3f476baeb6554beda801334e9269f64f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f331.bin
01eeb9b2d8e10077b9b235626a389d3b12e3e2b8e2b5ee375c4697f40f723136		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF331 5356 bytes
font_01_sfnt_off00010561.bin
419c572829fb3e790d2cdc0aaa52f787e3bd44a5f96aa738654af278a883f54d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10561 10340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.