Malicious PDF — malware analysis report

Static analysis result for SHA-256 74b1cca58a24ff1e…

MALICIOUS

PDF

72.4 KB Created: 2021-03-02 16:05:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: f015b1839089f70a3f73717f4a63896d SHA-1: 60aedc29ec7db75f2831102a39a0892ee393a22c SHA-256: 74b1cca58a24ff1edfca3497c8eafe02b974a6be8a8bf9376887358d2c28656c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'seumenha.ru', which is likely used to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, appears to reference 'Farmall super m parts diagram' and metadata indicates it was generated by wkhtmltopdf, suggesting a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=farmall+super+m+parts+diagram PDF link annotation
    • http://banolapisa.iblogger.org/acc_aha_htn_guidelines_2017.pdfIn PDF document text
    • http://nuvifufaronez.22web.org/bafg_bayern_formblatt_praktikum.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409796/normal_600e77b095f42.pdfIn PDF document text
    • https://sitatovap.weebly.com/uploads/1/3/1/4/131438195/gexogem.pdfIn PDF document text
    • https://vakenufepuxino.weebly.com/uploads/1/3/4/5/134529081/8eb240d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481520/normal_601f7ed522691.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462059/normal_601b1a89bfac7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447267/normal_5fdc8730b7ed6.pdfIn PDF document text
    • http://rowowevu.mypressonline.com/how_to_connect_directv_to_fire_tv.pdfIn PDF document text
    • https://totakolexab.weebly.com/uploads/1/3/5/3/135391630/surem_fafopavis_pobigex_gugozalaponoz.pdfIn PDF document text
    • http://xiruzox.mygamesonline.org/basic_computer_tutorial_for_beginners_ppt.pdfIn PDF document text
    • http://tejovotemikodes.getenjoyment.net/1050545302.pdfIn PDF document text
    • http://farozemirig.scienceontheweb.net/krk_rokit_8_g3_price.pdfIn PDF document text
    • http://lukezelulevuf.22web.org/foxurelizuk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sesijesule/xobalesasawa.pdfIn PDF document text
    • https://s3.amazonaws.com/susonanezaj/kaxogajiwevijatesiwa.pdfIn PDF document text
    • https://s3.amazonaws.com/rozebofukixus/vscode_not_formatting_on_save.pdfIn PDF document text
    • http://wisivajenujeza.rf.gd/54458113134.pdfIn PDF document text
    • http://zamusokekegu.rf.gd/my_neck_hurts_when_i_look_up_and_down.pdfIn PDF document text
    • https://s3.amazonaws.com/wifiduxezo/38201277721.pdfIn PDF document text
    • http://lagixilutami.rf.gd/homophones_worksheets_grade_4_with_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB6A 5236 bytes
SHA-256: ac2b216f10ff0d466260694adf1964fbd9832cb640fd01549d72b0e046f10cf2
font_01_sfnt_off0000ed23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED23 11428 bytes
SHA-256: 7a661f17da9333bf2fe683c9e2c9b552102547b611e69b1b1a387b4783ae13cc

Open this report in the interactive analyzer, or submit your own file for analysis.