Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a8fe87006cecb68…

MALICIOUS

PDF

66.7 KB Created: 2021-01-31 02:41:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0a3ba314723dd05cdae6441364bbe5a SHA-1: d8d0ec12cee8e5d6ff4a277a478c6266161d79ee SHA-256: 6a8fe87006cecb68200d062e5aa822e7948050936008bb4ef364a313f750d99d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, 'seumenha.ru', which is likely used for phishing or to serve a secondary payload. The document body is heavily obfuscated and unreadable, but the presence of the external URI is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/aws?utm_term=bam+bam+bol+raha+kashi++gaana
    • https://static.s123-cdn-static.com/uploads/4366011/normal_6004a91688472.pdf
    • http://axecheat9.xyz/liderazgo_quantico_jorge_cuevas6kn81.pdf
    • https://static.s123-cdn-static.com/uploads/4451231/normal_5ff14818b1299.pdf
    • https://static.s123-cdn-static.com/uploads/4481676/normal_60090b091af65.pdf
    • https://static.s123-cdn-static.com/uploads/4471686/normal_5ffbfddf3e91d.pdf
    • https://static.s123-cdn-static.com/uploads/4452161/normal_6004afd5d8042.pdf
    • http://goodik.fun/adobe_acrobat_dc_crackiugcv.pdf
    • http://abreudesigns.com/handbook_of_interventional_radiologic_procedures_free_downloaddy91a.pdf
    • https://static.s123-cdn-static.com/uploads/4450641/normal_5fee370aea9ab.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lofese/nokelolexo.pdf
    • https://s3.amazonaws.com/temujonuwu/golixebemakikenupegetimo.pdf
    • https://s3.amazonaws.com/wuvepilamamuse/2019_yearly_calendar_with_holidays_template.pdf
    • http://zotawof.rf.gd/super_auto_typer.pdf
    • http://tegiledo.epizy.com/52560058788.pdf
    • https://s3.amazonaws.com/xufujofaleki/information_reporting_system_wikipedia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c5cc.bin
ef2a6d4738f5948085ce432c8f111eea27f2200d30a4fda0c0dfcb6f455328c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC5CC 5352 bytes
font_01_sfnt_off0000d7d0.bin
14d182d53339972003eb0a3f0d90fdd58fa09bf835e12e7a30c840513e4a80fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7D0 11584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.