Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3c36d9f8d51b114…

MALICIOUS

PDF

85.2 KB Created: 2021-03-09 15:45:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a7d9e1c43e385037a007d1ed92166b75 SHA-1: 7db50608f2b2932e66ee05547b4a4ba1bc304983 SHA-256: d3c36d9f8d51b1148ee42321ab4692d7ce8d058633daa61e2143d50623e4ca41
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'resalured.ru', which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to a 'ham radio technician study guide book'. No scripts were extracted, but the presence of an external URI and the ML/AV detections strongly suggest a phishing or malware distribution attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=ham+radio+technician+study+guide+book
    • https://static.s123-cdn-static.com/uploads/4487623/normal_5fe36dd255d16.pdf
    • https://cdn-cms.f-static.net/uploads/4410462/normal_5fd9c61fbbe67.pdf
    • http://help-nanny.site/convert_to_epub_acrobat_professionaleqn8o.pdf
    • https://static.s123-cdn-static.com/uploads/4447906/normal_5fc9e38a48ec0.pdf
    • https://cdn-cms.f-static.net/uploads/4420927/normal_5fd2efb70a407.pdf
    • http://zufepatajuju.22web.org/74468441782.pdf
    • http://xufunuduxatene.iblogger.org/dagixofarukupadeliwubudiw.pdf
    • https://cdn-cms.f-static.net/uploads/4449205/normal_6044fc44ab2f3.pdf
    • https://cdn-cms.f-static.net/uploads/4413865/normal_600c7e1fa41ec.pdf
    • http://xavelodezazil.iblogger.org/jorejunojikewomefa.pdf
    • http://gazozasi.scienceontheweb.net/8423143217.pdf
    • http://simimuvo.iblogger.org/vimiti.pdf
    • https://cdn-cms.f-static.net/uploads/4419236/normal_5fd19a8a30525.pdf
    • http://handler-autoscout24.com/renova_zero_pods_free_shippingusljl.pdf
    • http://mujudesuxiropa.sportsontheweb.net/zujukamifilebagi.pdf
    • http://ig-verifiedsbadge.com/trane_xr90_replacement_partslayms.pdf
    • https://cdn-cms.f-static.net/uploads/4379855/normal_5fd179699be27.pdf
    • https://cdn-cms.f-static.net/uploads/4489969/normal_5fe63d2fb8a76.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • http://www.daltonmaag.com/
    • http://zutugidod.onlinewebshop.net/hp_laserjet_1320n_wireless_setup.pdf
    • http://vivusefodubelep.epizy.com/how_to_cook_a_rib_roast_on_a_showtime_rotisserie.pdf
    • http://latarugumajovi.epizy.com/ceragon_ip20_user_manual.pdf
    • http://zodejewab.epizy.com/vikram_aishwarya_rai_song.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef1f.bin
b9ccb102e6979b71f790eaea8b6792d67b17129ac7755c1390939eb2c448ce04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF1F 5472 bytes
font_01_sfnt_off00010189.bin
58b4873d33ac9fffaf45ed1a2312b8eb5fadf3b067e77f8cfe9e87095f6a7717		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10189 6068 bytes
font_02_sfnt_off0001113a.bin
c30b3ff6d2b202c780404cde5135901f67d51337307d507af0586ee0b106184a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1113A 11584 bytes
font_03_sfnt_off00013897.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13897 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.