Malicious PDF — malware analysis report

Static analysis result for SHA-256 282c27d7adcb07f8…

MALICIOUS

PDF

80.8 KB Created: 2021-03-21 10:24:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 929f04950399dafee7b2293861b231dc SHA-1: 7e7b00a42ea24852179854a05270adb10ea773aa SHA-256: 282c27d7adcb07f899031925f5715fb3da3748e8deda6ca9cb548f2d8b0a8da2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to 'seumenha.ru', which is likely used for phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to a malicious site, consistent with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=death+soul+eater+voice
    • https://rixafewokeget.weebly.com/uploads/1/3/0/7/130739987/rifuxame.pdf
    • https://cdn-cms.f-static.net/uploads/4387810/normal_5fdbc480586b3.pdf
    • https://cdn-cms.f-static.net/uploads/4481684/normal_60134cce1a119.pdf
    • https://bufotikebejunut.weebly.com/uploads/1/3/1/3/131398235/336055ae.pdf
    • http://gumidaz.medianewsonline.com/sowamix.pdf
    • http://lulopoboxefon.scienceontheweb.net/16742186810.pdf
    • http://tojuvapemupo.mywebcommunity.org/cesium_chloride_structure.pdf
    • https://cdn-cms.f-static.net/uploads/4465538/normal_5fd0a96d4bf38.pdf
    • https://direnebem.weebly.com/uploads/1/3/4/6/134641367/c426ba2bd5.pdf
    • https://static.s123-cdn-static.com/uploads/4404313/normal_5fcbdb837eafe.pdf
    • https://vixezijimike.weebly.com/uploads/1/3/5/9/135993975/3829340.pdf
    • https://filukekab.weebly.com/uploads/1/3/4/4/134478490/kupazepajekosoz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/nagev/project_manager_cv_template_doc.pdf
    • https://s3.amazonaws.com/mejobu/whatsapp_status_pakistan_independence_day.pdf
    • https://s3.amazonaws.com/xapota/antivirus_app_android_github.pdf
    • https://s3.amazonaws.com/zasepo/xesadoxafofirapebaz.pdf
    • https://s3.amazonaws.com/mesixadelomomo/scales_chords_arpeggios_cadences.pdf
    • https://s3.amazonaws.com/lumixi/82719781798.pdf
    • https://s3.amazonaws.com/dorulusof/dulupolit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1b1.bin
a8479b930de175578075207acf2ea838b1d91aa36cf668a865d22f6afb8aa358
pdf-font-stream PDF embedded font (sfnt) at offset 0xF1B1 4720 bytes
font_01_sfnt_off000101e1.bin
032ead27d8c4331cf1c390d2f62e5f3dcc0dbe8f75856932ef4f10c6807223f7
pdf-font-stream PDF embedded font (sfnt) at offset 0x101E1 11364 bytes
font_02_sfnt_off00012828.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c
pdf-font-stream PDF embedded font (sfnt) at offset 0x12828 4324 bytes