PDF malware analysis — malicious · dc14b65c4b3f479a

MALICIOUS

PDF

76.2 KB Created: 2021-03-19 18:39:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a9da0eb3044467501d1f8ea4b15546ea SHA-1: 5cebb10f31d180c740fcc35b5550bf39d8e2f9eb SHA-256: dc14b65c4b3f479a089acc7080744f80b1205c7e5a12062394d7f389357d5d7f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'resalured.ru', which is likely used to host a phishing page or distribute further malware. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/wix?keyword=crabs+adjust+humidity+cards+list
- http://mosdendy.store/41878208072ww0ed.pdf
- https://cdn-cms.f-static.net/uploads/4387433/normal_6013c2677843d.pdf
- https://cdn.sqhk.co/wozokagad/uRBgh9w/languidez_significado_dicionrio.pdf
- http://hydraruzxpnew4af.exchange/sanawexznpv.pdf
- https://cdn.sqhk.co/diwiporeb/jaqgegd/history_of_islam_religion.pdf
- http://shopeuro.pro/127713799099kktb.pdf
- https://cdn.sqhk.co/rokajoten/QicgcbQ/62698305196.pdf
- https://cdn.sqhk.co/tigixexaxi/5jgayrc/cops_and_robbers_hack_apk.pdf
- https://static.s123-cdn-static.com/uploads/4426423/normal_5ffb899ed1def.pdf
- https://cdn-cms.f-static.net/uploads/4412382/normal_603b1ace0ffab.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/41fb9e16-a069-465d-94db-838ab7299792/86918166819.pdf
- https://s3.amazonaws.com/bifamomove/the_halloween_brain_teaser_quiz_answers.pdf
- https://s3.amazonaws.com/vuxalirudidel/22756731860.pdf
- https://uploads.strikinglycdn.com/files/1bdb3609-0787-4899-b584-fcc0de01dadb/76203906569.pdf
- https://uploads.strikinglycdn.com/files/cc8d721c-eaee-4773-abb9-5c1a421b542b/fexanana.pdf
- https://s3.amazonaws.com/kulinisokakewi/fifty_shades_of_grey_plot_structure.pdf
- https://s3.amazonaws.com/gezizefefififa/attendance_tracking_sheet_free.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ea80.bin` `b45cfd0e3c5ff059aab3635da96026278140c9c1a0787b1a61d58a2ee17bc0e0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA80	5404 bytes
`font_01_sfnt_off0000fcb6.bin` `b74a8c2b6e51477ffcc42008f17abc7a1cca39c2baa73181f458e551479db4b3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFCB6	11080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.