Malicious PDF — malware analysis report

Static analysis result for SHA-256 54a5e71584fdfb62…

MALICIOUS

PDF

91.2 KB Created: 2021-04-11 15:29:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 1846d4875ff6505755b7aa42bfa6c7e2 SHA-1: 5d739356bf97c366e355a2df8527b7a15742b867 SHA-256: 54a5e71584fdfb62dd7409ca21496a3c339cb7632dbb13b5b33e6cc0874342d4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was identified as malicious by ML classifiers and ClamAV, flagging it as a phishing trojan. The heuristic 'PDF_SEO_LINK_FARM' indicates the document contains a large number of external links, suggesting it's designed to redirect users to potentially harmful content. The embedded URLs, such as 'https://seumenha.ru/strik?utm_term=singer+201-2+sewing+machine+parts', are likely part of this malicious redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=singer+201-2+sewing+machine+parts PDF link annotation
    • https://cdn.sqhk.co/rubekafux/jRjaW68/wipezomuzokosisa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423430/normal_5fd1df8dab29e.pdfIn PDF document text
    • https://cdn.sqhk.co/nizufalagef/jhigjcc/burger_king_menu_prices_2020_deals.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450889/normal_606e6d0a09262.pdfIn PDF document text
    • https://cdn.sqhk.co/desiketomasu/hoqaMlz/govetirefewoga.pdfIn PDF document text
    • https://cdn.sqhk.co/wixikinotu/jdpVLAg/call_siren_head_in_real_life.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373511/normal_605dacb20113e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407994/normal_604ee9e7cdc97.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449599/normal_5fee9f5f41f2d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493876/normal_606100d5cbd79.pdfIn PDF document text
    • https://cdn.sqhk.co/pefevepufi/rWJCiey/18868224711.pdfIn PDF document text
    • https://cdn.sqhk.co/peferitukofa/aaKoZhd/titaxatu.pdfIn PDF document text
    • https://cdn.sqhk.co/gapalagabig/hbQMPhj/97533235865.pdfIn PDF document text
    • https://cdn.sqhk.co/zuxolusufa/djiaSgh/star_hero_story_mod_apk.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491164/normal_5fcac9414cd8d.pdfIn PDF document text
    • https://cdn.sqhk.co/daboxazile/ie0Xia9/21361559096.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371005/normal_60332de93d1f5.pdfIn PDF document text
    • https://cdn.sqhk.co/zetarizelub/PJjfEie/59747678828.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465133/normal_6010c7c160af9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://38c8c62e-1823-4c1e-8220-bc61efcc8a1c.filesusr.com/ugd/c24b9b_b1ab47548e154cfdba1ec43dfed4b34a.pdf?index=trueIn PDF document text
    • https://9d0a8b69-4790-495c-a4d5-ed29f3eef23c.filesusr.com/ugd/4cd51e_2187748c23d14db69619022bd7351456.pdf?index=trueIn PDF document text
    • https://676a7a22-5bec-432e-92e0-9d4a0a27851c.filesusr.com/ugd/a1fb72_700cd20ebefb4318b62ec5240b45277c.pdf?index=trueIn PDF document text
    • https://30b7a97f-6117-4fff-8876-4b3c2220b6c6.filesusr.com/ugd/15cd4d_4366654f88a8487094d2148af2f9f47c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012562.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12562 5868 bytes
SHA-256: 21c287943b66bba17b0b883e4da62ac4b2fcfb79132d4a404b39115a50eec2ce
font_01_sfnt_off00013952.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13952 11176 bytes
SHA-256: 791cdf0e4591153876783b9dd1bc766e27cc2f951bbb98868ceaa9fac7feaf79

Open this report in the interactive analyzer, or submit your own file for analysis.