Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0cdf9fb5e9b7b0e…

MALICIOUS

PDF

76.0 KB Created: 2021-03-31 11:50:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 643fa02b04180849e6523d6e83b97962 SHA-1: 1de39771a0889e05631a3bd01fd6d3af92442c3e SHA-256: b0cdf9fb5e9b7b0efd5700fefef2aacf96555975ee745692d899a0946790b921
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'resalured.ru', which is flagged as a suspicious external resource. The document body, though heavily obfuscated, contains text related to 'wkhtmltopdf' and a date, suggesting it might be a generated document. The presence of an external URI in a malicious PDF strongly indicates an attempt to redirect the user to a malicious site for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=caballo+de+troya+5+cesarea+pdf+gratis
    • http://mebutef.22web.org/wavenopodosonajep.pdf
    • http://ditalemidego.22web.org/how_do_i_get_my_fios_remote_to_control_the_volume.pdf
    • http://bojexatonumeme.iblogger.org/67953576656.pdf
    • https://cdn.sqhk.co/ratevusur/Mdhdhdk/spelling_games_for_adults_app.pdf
    • http://openlait.pro/86796842755y5hdh.pdf
    • http://sedouche.xyz/fifth_grade_english_worksheetshpmts.pdf
    • https://cdn.sqhk.co/febowozefu/icH1ijZ/vojupe.pdf
    • http://seplafond.xyz/kuvuteviga516qp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://diwigivexuvobe.epizy.com/10135752993.pdf
    • https://e62d90d9-845b-491d-b9b1-804d55ccd6e6.filesusr.com/ugd/6af1ed_71374fd85fb9425a877c978003071fa1.pdf?index=true
    • https://s3.amazonaws.com/marimejerebo/placenta_previa_rcog_patient_information.pdf
    • http://zawuzujuw.epizy.com/68956912634.pdf
    • http://duwamiwimi.rf.gd/34530684461.pdf
    • https://s3.amazonaws.com/wifukedot/compatibility_report_natal_chart.pdf
    • https://s3.amazonaws.com/bifamomove/personal_autobiography_examples.pdf
    • https://c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com/ugd/957c7b_182ebe30d3ae4c14836d12517dc91f9c.pdf?index=true
    • https://s3.amazonaws.com/falejogajir/69817939034.pdf
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_a904b5d9c3f54d1cbd1dcf992a61d8b0.pdf?index=true
    • http://depupumuda.rf.gd/android_emulator_camera_rotated.pdf
    • http://kudawugijamino.rf.gd/xezeruxizuzepawu.pdf
    • http://dogolapobu.rf.gd/industrial_pipe_prices.pdf
    • https://4a31e3f8-49e3-4331-b1a9-c0bb7a6b9dbc.filesusr.com/ugd/599f1c_16f510d34e2746a897afaec7321c910a.pdf?index=true
    • https://s3.amazonaws.com/jejulurowev/33040604909.pdf
    • https://0621cc9e-6449-4e8a-a8bd-baee9ad62a2c.filesusr.com/ugd/affb4a_0083fc5d72fa48a292c97772d8ffa2f3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d188.bin
2f3b1867c2823d198ff0ee7c004f77d3d149e407a49d2fd60abc11c6705f1f98		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD188 5592 bytes
font_01_sfnt_off0000e49f.bin
d453152ca7c14c964943661ea09331fe28a4c1852e1694c89e62a944778f34ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE49F 11900 bytes
font_02_sfnt_off00010b86.bin
1ffca1ef16be5e2ec436e77f9211a88ad3199dc781cb76600401cc2e2c7dce6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B86 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.