Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ba2a5a968c3d634…

MALICIOUS

PDF

80.9 KB Created: 2021-04-14 09:50:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 171ff7e668e01f2b2f9d54c1c41b33b5 SHA-1: 1447ef2517a378c522df624794bf619fcf5ca225 SHA-256: 9ba2a5a968c3d634412d7c8adbda224c23c4cf5dd4cfac4d485c1740db708431
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDFs, suggesting a link farm designed to manipulate search engine results or distribute malicious content. One prominent URL, 'https://resalured.ru/strik?utm_term=gre+words+free+android+app', is likely the primary lure, attempting to trick users into believing it offers a free Android application. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=gre+words+free+android+app
    • https://cdn.sqhk.co/fuvebopeweb/eD7ZX7U/47396249232.pdf
    • https://lurafavef.weebly.com/uploads/1/3/0/8/130813461/1125470.pdf
    • https://cdn.sqhk.co/manigonodapu/gTtliiL/voa_burmese_radio_news_morning.pdf
    • https://static.s123-cdn-static.com/uploads/4447263/normal_5fc5995090b0c.pdf
    • https://cdn-cms.f-static.net/uploads/4419441/normal_601a1a2f07a05.pdf
    • https://cdn.sqhk.co/zalenemu/iaugjgP/king_of_thieves_movie_review.pdf
    • https://wenuzivubog.weebly.com/uploads/1/3/5/3/135392435/lifokazuzizago.pdf
    • https://cdn-cms.f-static.net/uploads/4500189/normal_601783618ca77.pdf
    • https://cdn-cms.f-static.net/uploads/4382196/normal_606685bc03ff5.pdf
    • https://kilewesiviteki.weebly.com/uploads/1/3/1/1/131163613/fb64c5d9dda.pdf
    • https://cdn-cms.f-static.net/uploads/4377908/normal_606a28809822a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8cff94d3-ecab-4ea5-ad27-d3e67d02fd32.filesusr.com/ugd/2813e2_603f8cab2306410f83c21cb9d8056ab1.pdf?index=true
    • https://s3.amazonaws.com/zobuwubedak/26220986896.pdf
    • https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_ff7d57daa71e47c79707a13e196dde4a.pdf?index=true
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_22e5832833a24f79bd52d9c71c52c0ad.pdf?index=true
    • https://6ae5a9c1-8526-45f7-b068-03ddf2465b28.filesusr.com/ugd/87f732_6df0b4e4587746c89de6a419f46eb857.pdf?index=true
    • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_54c46475461d453694361f7ef6b2e17e.pdf?index=true
    • https://s3.amazonaws.com/gezetega/budupugekodolilojudorur.pdf
    • https://s3.amazonaws.com/mejados/88798101071.pdf
    • https://s3.amazonaws.com/xumakomowi/twilight_saga_all_series.pdf
    • https://9849c7ec-8b19-4b81-9a64-db2537ea7c40.filesusr.com/ugd/97b1c0_6912475dffbf4a788bcb9f485afbf9fb.pdf?index=true
    • https://e824aeac-d22a-4b45-bb3c-17051d6ee04f.filesusr.com/ugd/de60da_336792cc36c34c62b2613c1b86261f6c.pdf?index=true
    • https://6184de0c-c318-42a7-882e-c5ddc63b817d.filesusr.com/ugd/1c8c1e_ff1be3c079b24841be23eb32968db3f1.pdf?index=true
    • https://s3.amazonaws.com/fosagobomap/13959784335.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fed8.bin
b527015822dc7bfb30cf90ebde80f905f5e25851354d557cfe2cf7af76babf8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFED8 5124 bytes
font_01_sfnt_off0001106f.bin
a4902e9c750698f85feeb3a32178e4b26f5eef0ec534242f9eb9973c0e63568d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1106F 11032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.