Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd3d4855927afae6…

MALICIOUS

PDF

85.5 KB Created: 2021-03-13 12:41:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5a11d0e4c31ca729f411c376043f124 SHA-1: 22e1c6c3a95941d24757d499fcf0416b6d77f689 SHA-256: dd3d4855927afae61594bab3635ff79bda45ed77fecdc69c64a62b5b4ea1b3bc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with the primary one being 'https://resalured.ru/wix?keyword=gfl+singularity+guide', suggesting a lure to a malicious website. The document body is heavily obfuscated, but the presence of external URIs and the high ML score indicate a probable attempt to redirect the user to a compromised or malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=gfl+singularity+guide
    • http://fotubobuwenapu.scienceontheweb.net/binurakipivoxuse.pdf
    • https://cdn.sqhk.co/talokelom/ieigIjg/rust_colored_moth.pdf
    • https://cdn.sqhk.co/juvadujud/4hglheA/brick_blast_ball_game_download.pdf
    • http://kobopez.mygamesonline.org/pudivefer.pdf
    • https://cdn.sqhk.co/gunonutib/jiciiji/woodworkers_source_in_tucson_hours.pdf
    • http://galosidijixiwu.mypressonline.com/john_deere_x320_pto_problems.pdf
    • https://cdn.sqhk.co/bogulevim/XjaUheL/75592709351.pdf
    • https://cdn.sqhk.co/pimepojuti/ghhcjjk/big_bang_theory_full_episodes_dvd.pdf
    • http://pearhaidhr.fun/bella_rotating_waffle_maker_recipes4ruru.pdf
    • http://leporabev.mywebcommunity.org/27598379282.pdf
    • https://cdn.sqhk.co/nezotelo/ggihGgj/rudibixu.pdf
    • https://cdn.sqhk.co/refevebux/dBiigcP/tusodete.pdf
    • https://cdn.sqhk.co/fowipovoji/f6gfaQ9/project_report_on_ludo_game_in_c.pdf
    • http://vodoroding.info/funny_song_ringtone_zedgej34iz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/kujapomib/49431898695.pdf
    • http://girofili.myartsonline.com/33052530631.pdf
    • http://gixarewujedel.atwebpages.com/math_4_trig_ratios_worksheet_answer_key.pdf
    • https://s3.amazonaws.com/voropa/18302484912.pdf
    • https://s3.amazonaws.com/sulasatevirexo/glass_sword_twilight_forest.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef3d.bin
0dbd1a6c7e7e9cc8275268de59b6a55db6d847d39d3038b7a6f02b0169a17316		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3D 4980 bytes
font_01_sfnt_off0001003a.bin
244c4eb3daecd31bea643cf27a255d48375af4d6603f69d1b9e08c3c96bed94b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1003A 10768 bytes
font_02_sfnt_off0001254f.bin
ea75db71c9df7250347a03039f742fcd189f5fc3f08964e696816fa8b5227073		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1254F 16092 bytes
font_03_sfnt_off00013a17.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A17 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.