Malicious PDF — malware analysis report

Static analysis result for SHA-256 443162e0bed3d795…

MALICIOUS

PDF

85.7 KB Created: 2021-04-25 14:14:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bbac6c9c1ef0118d2aecfd0d3acea88f SHA-1: df9fc4ebf99932e6f860216ea2ddeb0a3c547463 SHA-256: 443162e0bed3d795622db46fa2905aeffea8c3658cf7f2e645cb65c7f028264e
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a phishing document with a link farm, designed to lure users with urgency and payment-related language. The embedded URLs, particularly 'https://seumenha.ru/strik?utm_term=what+charger+does+jbl+xtreme+use', are likely part of this phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=what+charger+does+jbl+xtreme+use
    • http://pusewuvi.medianewsonline.com/mofeluju.pdf
    • http://rasipafus.getenjoyment.net/lewivokud.pdf
    • https://rusakubasarozu.weebly.com/uploads/1/3/4/2/134266120/zipojiv.pdf
    • http://lazokiwumemo.mygamesonline.org/oxford_discover_3_workbook.pdf
    • http://moxawunanenubop.sportsontheweb.net/adjectives_english_french.pdf
    • https://lififamofupuge.weebly.com/uploads/1/3/4/3/134317858/lemobepemibejajaku.pdf
    • http://zagavexakagin.mypressonline.com/hepatic_encephalopathy_2020.pdf
    • https://dutajedi.weebly.com/uploads/1/3/5/9/135964159/3180220.pdf
    • http://gixitetopes.scienceontheweb.net/kezotowor.pdf
    • https://zupalopozaguri.weebly.com/uploads/1/3/2/3/132302876/34a2f2b2b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gixawetopoli/sisitigawoderuzaludikeze.pdf
    • https://s3.amazonaws.com/zesotat/45324968524.pdf
    • https://s3.amazonaws.com/dusined/gcse_science_questions_with_answers.pdf
    • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_6f5d3564ad3d4acca883d9a9b10e8110.pdf?index=true
    • http://bumurulepowele.myartsonline.com/rains_of_castamere_violin_sheet_music.pdf
    • https://d4e73f68-9870-4c81-be0c-0a6dd7607cd2.filesusr.com/ugd/6f53d7_2dd102bd3fd24c21bf79cdd591c9c600.pdf?index=true
    • https://s3.amazonaws.com/fovezewi/71321295730.pdf
    • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_455f5b32c30e4b31abc636af613bac55.pdf?index=true
    • http://galojuxutiwas.epizy.com/93965568458.pdf
    • https://s3.amazonaws.com/rekorewexidiwo/tunepabazixesivajowiku.pdf
    • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_07feb9eed13246519eb0be8db277b4c1.pdf?index=true
    • http://xurosuforudev.atwebpages.com/55446397685.pdf
    • http://wamulax.epizy.com/pivumosagulujireg.pdf
    • http://xexovigir.epizy.com/firisabilavamuzuribug.pdf
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_0fd6eb6c2e554cc4a8679b405fe8f200.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4ea.bin
13477c35829ab650e4c3941858c46ebffae7422919621de420c7e1b9b6ef0b2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4EA 5652 bytes
font_01_sfnt_off00010806.bin
860aa0293430ff754ce36db8f26c716538659e05f2761b9e5ec6248819c86aef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10806 14252 bytes
font_02_sfnt_off00013480.bin
1c7796c209fc496375b69af1391759dc009ec5e11a9b660bb62820890f2e1d74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13480 16064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.