Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e80af88d7b9450f…

MALICIOUS

PDF

161.4 KB Created: 2021-03-20 23:25:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 829c273c6ab59fc30a0e32a02a45f917 SHA-1: b69bd8688132a87c9e8051f6d8dd9c26cfa2e0d7 SHA-256: 9e80af88d7b9450f753476e01934d041729a7c19ef722b0576d1b10f19adcfc4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URL pointing to 'resalured.ru', which is likely a phishing or malware distribution site. The document body appears to be corrupted or obfuscated, but the presence of the malicious URL and the overall detection strongly suggest a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=rectangular+waveguide+guided+wavelength+calculator
    • https://cdn-cms.f-static.net/uploads/4454668/normal_60381def474e8.pdf
    • https://puviguwa.weebly.com/uploads/1/3/0/7/130776677/29ba6f15.pdf
    • https://static.s123-cdn-static.com/uploads/4413454/normal_5ff1786a5f139.pdf
    • http://interior.estate/how_to_look_up_my_texas_drivers_license_numberzqp7a.pdf
    • https://static.s123-cdn-static.com/uploads/4460972/normal_5ff2115a66085.pdf
    • https://cdn-cms.f-static.net/uploads/4413013/normal_604edba63d717.pdf
    • https://zezexofoji.weebly.com/uploads/1/3/4/3/134344156/3863013.pdf
    • http://7gusevshop.website/jelukunetisup7i1g.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6677bd9e-daf3-4b0f-adc0-d4e06bf096a8/the_game_of_thrones_story_summary.pdf
    • https://uploads.strikinglycdn.com/files/8f2db726-574c-468c-a843-a566bd1c0812/how_to_set_up_voicemail_on_lg_phone.pdf
    • https://uploads.strikinglycdn.com/files/fa5edef6-cdf2-42d8-8f8f-a205b91e02f8/cuales_son_los_titulos_de_credito_nominativos_y_cuales_al_portador.pdf
    • https://uploads.strikinglycdn.com/files/bc5555c7-509d-42c7-ac22-d4517d566d8b/27008470523.pdf
    • https://s3.amazonaws.com/webipejonavuv/most_confusing_riddles_with_answers.pdf
    • https://s3.amazonaws.com/wetevali/catalogo_avon_campagna_17_2018.pdf
    • https://s3.amazonaws.com/vudivuzakal/cbse_net_previous_question_paper_with_answer.pdf
    • https://uploads.strikinglycdn.com/files/a0bee435-2de6-4573-8ebe-27381461bdfe/curso_de_ingles_gratis_basico_para_nios_y_principiantes.pdf
    • https://uploads.strikinglycdn.com/files/694afd0e-3831-422e-9b17-9093f67ea56e/xuputikerugo.pdf
    • https://uploads.strikinglycdn.com/files/a2abb6bf-af35-4977-90e5-a1e21d5e29e1/dinolutul.pdf
    • https://uploads.strikinglycdn.com/files/a4fd8fe6-c3b6-41cb-962c-4ab44ff3b725/windows_7_set_auto_login_registry.pdf
    • https://uploads.strikinglycdn.com/files/48891af8-a776-497f-b845-ab2813e8dd15/1852028394.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021399.bin
193ce0c36bfe545e6b70e1bdc4bdac6a469c2aa959ae8855eb9af1cd3909aeed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21399 2908 bytes
font_01_sfnt_off00021dfb.bin
23cce1936251179a60678168d36b3c1279c417ed1dc1f636d6407186a2fe83d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21DFB 5180 bytes
font_02_sfnt_off00022faf.bin
8619961c8d62656ee0d28b17606b3cdb6fec5fbcb0338c26677cb18f17fe74eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22FAF 13532 bytes
font_03_sfnt_off00025e0a.bin
2aec090af82709f95ebf77d2ae619ad76ebadcc93944bc143436dc45e77eabab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25E0A 17452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.