Malicious PDF — malware analysis report

Static analysis result for SHA-256 a745e78c34152d76…

MALICIOUS

PDF

84.3 KB Created: 2021-03-22 10:13:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 0b79faf652f6e3b32f2bb91ca9d43da2 SHA-1: bbe16be7599db900ffd0e7ef560cb962a81559be SHA-256: a745e78c34152d760e752fa4fe375e31641189c952994610af2618732af99458
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains a high-confidence heuristic firing for a phishing lure, specifically an image linking to an SEO redirector. The embedded URL `https://resalured.ru/award?keyword=the+borderline+personality+disorder+workbook+pdf` is the primary indicator of this phishing attempt. ClamAV also detected this file as `Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0`, further supporting the malicious classification. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=the+borderline+personality+disorder+workbook+pdf PDF link annotation
    • https://liletalezawo.weebly.com/uploads/1/3/4/5/134591830/gojivoxasuv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384468/normal_602ef9ab87559.pdfIn PDF document text
    • https://cdn.sqhk.co/talokelom/iczeQjh/angry_fighting_attack_mod_apk_android_1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448719/normal_600398ce6091e.pdfIn PDF document text
    • https://cdn.sqhk.co/tizesefetus/cu7XpH5/football_field_size.pdfIn PDF document text
    • https://fudidokogi.weebly.com/uploads/1/3/4/6/134603759/3158914.pdfIn PDF document text
    • https://migofaxukov.weebly.com/uploads/1/3/5/3/135394112/510aaa9cd9321.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426819/normal_6046eb85ae208.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484612/normal_6050cc8f0fa6a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384482/normal_600344e7aa142.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jezobasit/82500993698.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9088a21-c5de-474d-bcbe-dbdb542d242c/51379193292.pdfIn PDF document text
    • https://s3.amazonaws.com/nafamaragisek/anime_tube_unlimited_ios.pdfIn PDF document text
    • https://s3.amazonaws.com/lezerawe/18840227918.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6b64412-aec1-4876-b425-1373053f4ded/fallout_4_companion_perks_ranked.pdfIn PDF document text
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_b01a8614e129433283cbb11a6abcc0a8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c30cfbe-dd58-4cc7-a7ea-9f1e3eae7ba7/81698879901.pdfIn PDF document text
    • https://s3.amazonaws.com/waxegatulo/jojugaropakepovise.pdfIn PDF document text
    • https://a49aa754-465e-4bbd-924e-b3d0e7b66bd4.filesusr.com/ugd/81d6a4_a017726e222f43b298a188cb76c8bf99.pdf?index=trueIn PDF document text
    • https://8ab1a2d5-e5b1-44c5-a28c-e09959565f0d.filesusr.com/ugd/eb712c_a78880127ad443c3b412a607d8bc9541.pdf?index=trueIn PDF document text
    • https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_cd2b840c28ba4fc3b72de3c2129989d3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3345149-963d-4370-a4b6-ddad38ccd06e/hound_of_the_baskervilles_1959_full_movie.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD4B 5264 bytes
SHA-256: b6eb09447310d06a27d3e5abc6de11a2fa9150a0a9ff274266bef0c8dc4a647d
font_01_sfnt_off00010f29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F29 11152 bytes
SHA-256: 3d6512663c79261abeaa3f1123381637d25e70080377ec16edcef389adf433b7
font_02_sfnt_off000134ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134FF 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c