Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a427ca5bb50fab9…

MALICIOUS

PDF

79.0 KB Created: 2021-03-05 10:45:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: cad4b322bbcedb1fbdc0b6f178963456 SHA-1: e0e110fbefa2ac90f96abdcc6a74246915c63320 SHA-256: 9a427ca5bb50fab9e4e01d5cdb0f1346e218fd56ec7191f7e5cc5e70ff16ec2c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' and 'PDF_URI' heuristics. ClamAV also detected the file as 'Pdf.Phishing.Trojan'. The primary malicious URL identified is resalured.ru, which is likely used to host phishing content or distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=molecular+biology+of+the+gene+7th+edition PDF link annotation
    • https://cdn.sqhk.co/dibirolinu/wZNX6hc/pub_quiz_planet_questions.pdfIn PDF document text
    • http://plusstore.pro/jugimofedvkpye.pdfIn PDF document text
    • https://cdn.sqhk.co/kupuvikadob/jgSjjjd/daxozibakadewoboxu.pdfIn PDF document text
    • http://cosmeteca.com/25085835746y7fso.pdfIn PDF document text
    • https://cdn.sqhk.co/tupipitijil/Agjjfge/59870657193.pdfIn PDF document text
    • https://cdn.sqhk.co/riwifesineji/6ja3Qih/wagitagunurad.pdfIn PDF document text
    • https://cdn.sqhk.co/jurugaguvedu/GwgnLgf/47733452889.pdfIn PDF document text
    • http://bestpriceforukraine.xyz/915692886661lx1b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a65e62a-1a15-4624-be87-bdb71d1c7c01/how_to_thank_your_boss_for_good_feedback.pdfIn PDF document text
    • https://a161ff94-1a6f-4367-b6f8-8e513a5e676d.filesusr.com/ugd/4c7633_48e9a0d2207f4293885a6ccbddc3254d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/19878602994.pdfIn PDF document text
    • https://s3.amazonaws.com/sajezife/lonely_planet_indonesia_guide_book.pdfIn PDF document text
    • https://c83cbd6e-a134-4b49-ba12-49f24c654ad9.filesusr.com/ugd/904a8b_cebc646f27614f678e1a5af0fc239677.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fosawef/metformin_pcos_pregnancy_success.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a103a446-f817-432f-9156-bfefa0ee0c76/how_to_clean_black_and_decker_coffee_maker_cm2046s.pdfIn PDF document text
    • https://s3.amazonaws.com/wumodukubaru/opportunity_cost_practice_problems_with_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/boduxatavepe/jepokedomoterolal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4a504a1-c05a-43d2-9955-d1810c0f7cf5/bisom.pdfIn PDF document text
    • https://s3.amazonaws.com/dezajok/minions_wallpaper_free_for_mobile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b874ecdc-6c0f-4e85-b635-13f8fae4dc18/86469453423.pdfIn PDF document text
    • https://52ed6390-a5c1-4502-9f93-599cf6d98ad1.filesusr.com/ugd/f7fbc8_53af6c63af1a4921bd085ec4097611dc.pdf?index=trueIn PDF document text
    • https://b9a4c3d6-4ccf-4d04-9b0f-c2e9c357e15d.filesusr.com/ugd/e5cbe5_7675ceaf7c354640a08e3b3b0eb17042.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8d2ab3f-892f-460b-9f16-71ef24343f9f/pekos.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6CD 5432 bytes
SHA-256: fd2e045754f1a7995735ac0a4163910918178bc292289c48a6c96eded935e0bf
font_01_sfnt_off0001095f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1095F 11020 bytes
SHA-256: 74f1337f58e0e5b300a6b8655ddefbdce5726db282d4bd9e7423308e12cb1773

Open this report in the interactive analyzer, or submit your own file for analysis.