Malicious PDF — malware analysis report

Static analysis result for SHA-256 669b92b3cbaef00a…

MALICIOUS

PDF

93.9 KB Created: 2021-02-02 00:13:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 057489f575e0aafec9d720b063be34e8 SHA-1: 75e83ab5b13c73dfa1d912f5f46bee863045c21d SHA-256: 669b92b3cbaef00aa28b89ae08bf80dc1a7beea6cc8971820d919256d891efd3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL, identified by the PDF_URI heuristic. This URL, https://seumenha.ru/123?utm_term=molar+mass+of+cr3%2528aso4%25292, is likely part of a phishing attempt to redirect the user to a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=molar+mass+of+cr3%2528aso4%25292 PDF link annotation
    • https://turudesufexo.weebly.com/uploads/1/3/4/1/134131379/8deba25.pdfIn PDF document text
    • https://guzajemifuraruv.weebly.com/uploads/1/3/0/8/130874286/noligasafeg-lilerefudupas.pdfIn PDF document text
    • http://pipvip.ru/60304366681r89t4.pdfIn PDF document text
    • http://firstdoctor.xyz/nogetaruminimojijukujigitcw7mn.pdfIn PDF document text
    • http://fastpeysistem.online/mazoninakasumasaripov375n5.pdfIn PDF document text
    • http://fly-drive.online/camera_cho_android_tv_box4qkk7.pdfIn PDF document text
    • http://shoop-fm.ru/machine_learning_algorithmsewrkt.pdfIn PDF document text
    • http://medicinfo.online/the_sims_freeplay_mod_apk_unlimitedmvky3.pdfIn PDF document text
    • http://subfamjtii.site/black_decker_workmate_400_manual7oem8.pdfIn PDF document text
    • http://soldonlittleton.com/movawadjcq8o.pdfIn PDF document text
    • https://wisapemewe.weebly.com/uploads/1/3/4/7/134713478/4992216.pdfIn PDF document text
    • http://fragcups.com/602810936093dmjq.pdfIn PDF document text
    • http://7lessons.space/56005392154gcfof.pdfIn PDF document text
    • http://24goodstore.site/party_beyonce_music_video_directorsi0vg.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jemazejodep/39454733018.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibebulosaxug/la_la_la_mp4.pdfIn PDF document text
    • https://s3.amazonaws.com/xanunafojuloki/predictable_revenue_aaron_ross_free.pdfIn PDF document text
    • https://s3.amazonaws.com/wuxupewu/87417641478.pdfIn PDF document text
    • https://s3.amazonaws.com/fejatepudopito/is_darrell_sheets_still_married.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE86 7024 bytes
SHA-256: c0ff9b46007da4e37fc832671c2c47b1ddada4527a0809cfffe9044bba68ed98
font_01_sfnt_off00010570.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10570 5008 bytes
SHA-256: 5c6be929113daf8121f5a8b85a76518670d412d99907734f7507e1145012ed56
font_02_sfnt_off0001167c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1167C 13984 bytes
SHA-256: 268a05a231cf158c7240b66cfd92cc000a214941af1982d6b0cbfcd70e1aeed6
font_03_sfnt_off000143db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143DB 16604 bytes
SHA-256: d2e1e40bcf046900f6228e481aa5fc8d4a6e7e546d6be5a2fc875629b21956de
font_04_sfnt_off00015ad3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15AD3 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.