Malicious PDF — malware analysis report

Static analysis result for SHA-256 c962d0fa363e340d…

MALICIOUS

PDF

76.9 KB Created: 2021-03-28 09:18:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b560d33d42c23e3c6e63c406062c8a52 SHA-1: d83fbbb2802a9bfbbbbc242dbc34ee490d987197 SHA-256: c962d0fa363e340dd27dfabef8b741ce0b7bf1082b10afb0100b3a5b0b2ff80d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a PDF link farm and a ML classifier. It contains numerous external URLs, with a primary focus on `resalured.ru` and `fasad-dom.site`, suggesting an attempt to redirect users to potentially malicious content. The document body, though heavily obfuscated, appears to be a lure related to academic engineering topics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=agricultural+and+biosystems+engineering+pdf
    • http://fasad-dom.site/22940530713o79g1.pdf
    • https://jimivisimobud.weebly.com/uploads/1/3/4/9/134901817/lolexokege-kofiviwabuju.pdf
    • http://labincom-med.ru/kenmore_600_series_dryer3zhwr.pdf
    • http://reduslim-officialsite.site/wesojupen7u4k.pdf
    • http://mydenverneighborhoods.com/definition_of_non_programmed_decisioniuncx.pdf
    • https://jalizirut.weebly.com/uploads/1/3/5/3/135308553/d3d2ef84c554.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bfb84b6e-7071-4a10-bd3f-24f91a387d90/dibutedunofa.pdf
    • https://6fd4412c-3e6e-4f21-a9af-8137ffc6c0d9.filesusr.com/ugd/03469c_0fab81672e094bea8f2529b217627f01.pdf?index=true
    • https://2e8e3215-33bf-4fe1-bc67-b38dac560527.filesusr.com/ugd/269bb8_f05af668de9b4ab494ff135b7752620b.pdf?index=true
    • https://s3.amazonaws.com/debiwelof/xivavutofosidimifas.pdf
    • https://s3.amazonaws.com/lusabifef/fupujegedagapepuv.pdf
    • https://uploads.strikinglycdn.com/files/e2ac8cb0-1849-402e-a7a1-d1ea8918ff53/nevorewunufazivaweje.pdf
    • https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_a37bd15994574e0a84bdf48073d31644.pdf?index=true
    • https://uploads.strikinglycdn.com/files/31a0c174-f17a-4a8b-930b-59baafc1fa1b/78444555267.pdf
    • https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_15d98635231d4af599c78d00588f97cc.pdf?index=true
    • https://8dfd47f4-e591-4377-92a3-bdbf91d41e5a.filesusr.com/ugd/a58b01_cc6a53bb5bc6458ba59b746833facefd.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb91.bin
86ff4c7631970a2fdebf62552877081707cd1a6d105994244da63f03ec31a644		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB91 5708 bytes
font_01_sfnt_off0000feec.bin
e4e8f73126fcf6e48b0e48f6ec8c289863a27d60b8da571d6ecb101ea4f133e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEEC 11224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.