Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5dddfeb5e3dbcf7…

MALICIOUS

PDF

71.3 KB Created: 2021-03-21 04:56:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c9de8395136c1738dbb1405d376c1f6 SHA-1: e7e80235a954abd9dcab017e75939f94d81ea432 SHA-256: d5dddfeb5e3dbcf7c2c5daaf980d78e3fe20ec7cf59f48932a23a30c8ca07bb4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a primary focus on 'resalured.ru', which is flagged as suspicious. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as a phishing trojan. The presence of embedded URLs and the structure suggest an attempt to direct users to malicious content, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=old+richmond+elementary+winston+salem
    • http://suzamajotibe.mywebcommunity.org/how_to_eat_move_and_be_healthy_paul_chek_books.pdf
    • http://vipadobotisituz.mygamesonline.org/37782936163.pdf
    • http://moxegelubopidi.sportsontheweb.net/project_management_career_opportunities_in_kenya.pdf
    • http://xovebud.mygamesonline.org/15722879114.pdf
    • http://trastenmyqort.online/quantitative_aptitude_questions_for_bank_po_examgen4a.pdf
    • http://zavodtriumf.com/what_are_the_zeros_of_the_polynomial_function_fxx3-5x2-6xr0z5q.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://dae57379-2785-4108-a223-4562ecbfc22e.filesusr.com/ugd/87ad98_f801aa01ca6f447e90c1d399e5f6da5c.pdf?index=true
    • http://wawavaroxu.myartsonline.com/alloys_and_intermetallic_compounds.pdf
    • https://s3.amazonaws.com/zuses/watch_over_synonym_formal.pdf
    • https://s3.amazonaws.com/wozowuledij/wosuwigivedupisokikubi.pdf
    • https://s3.amazonaws.com/vogubivajavofu/age_of_empires_macbook.pdf
    • https://s3.amazonaws.com/jemisajoda/gedubanufudezufogomunaw.pdf
    • https://599b09cd-7b6a-4758-94a3-08a08d316165.filesusr.com/ugd/628a76_c28a668740494f7e9d50de8b6c1ade99.pdf?index=true
    • https://d86ad34a-7df2-4f47-937b-a12ab5abc0fa.filesusr.com/ugd/8cbfce_e6332eadd1f9494abb5482c3375ee971.pdf?index=true
    • https://s3.amazonaws.com/bofake/83753033153.pdf
    • https://s3.amazonaws.com/tetofamuxulil/juvozitobedorakuxorakapef.pdf
    • https://uploads.strikinglycdn.com/files/60380b2c-3533-4242-8acb-720ff9a92668/finland_education_system_in_tamil.pdf
    • https://198d5876-2e36-4a54-a59d-b4c1060b65be.filesusr.com/ugd/4733ca_1454cabe3af847b0a6418e2ce7f0345e.pdf?index=true
    • https://s3.amazonaws.com/loxopudizus/vajujewixifefipituzajedam.pdf
    • https://uploads.strikinglycdn.com/files/dcd9bf4c-b57c-4bda-9a0a-de8300292241/how_to_fix_e1_error_on_jack_sewing_machine.pdf
    • https://s3.amazonaws.com/sutawowirosuvuv/66653164142.pdf
    • https://s3.amazonaws.com/tumasun/21056151604.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d741.bin
2ed66c873f422fec6e47beac130ab95cfffd07a82abb9e97a3b4d6a31f6c4576		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD741 5400 bytes
font_01_sfnt_off0000e97f.bin
1e62f85df8ff3e1a6d021abd385a82f047a23c149008ef8e9991d2db5a44607e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE97F 10824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.