Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f77266b408c2035…

MALICIOUS

PDF

75.1 KB Created: 2021-05-03 11:26:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 19c1011b4bdaf36746811c66fc04beb8 SHA-1: 12b90cda03edffc3f074719bd1d5d6ca7744e117 SHA-256: 7f77266b408c20352dbd951ba12250f07810dbef2d1a6842ec9bfd7d9a868bf0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to 'https://seumenha.ru/strik?utm_term=cisco+ccnp+security+books+pdf', which is likely a phishing lure. The document body, though heavily obfuscated, contains text related to Cisco CCNP security books, suggesting a pretext for the malicious link. No scripts were extracted, but the presence of external URIs and the overall malicious verdict strongly suggest it's designed to redirect users to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=cisco+ccnp+security+books+pdf PDF link annotation
    • http://storeeuro.info/java_64_bit_ziptiypn.pdfIn PDF document text
    • https://cdn.sqhk.co/firavibaw/dfid9RN/fargo_movie_imdb_parents_guide.pdfIn PDF document text
    • http://mignonette.space/lediwivimficpp.pdfIn PDF document text
    • https://cdn.sqhk.co/sofuxizago/idoAAjb/37179537421.pdfIn PDF document text
    • http://wisecredit.info/73469915240ytst9.pdfIn PDF document text
    • http://greatmasters.biz/the_alienist_book_endingzdf7z.pdfIn PDF document text
    • https://cdn.sqhk.co/sobexofap/j8hajeQ/best_30_day_home_workout_app.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dazinibonofobi/brady_label_printer_templates_word.pdfIn PDF document text
    • https://s3.amazonaws.com/kovezodepugov/expressions_and_equations_6th_grade_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/fatisake/bobira.pdfIn PDF document text
    • https://s3.amazonaws.com/zafijukopa/xigonovidugosupunebifulun.pdfIn PDF document text
    • https://s3.amazonaws.com/mekonulegipero/finding_asymptotes_of_rational_functions.pdfIn PDF document text
    • https://s3.amazonaws.com/muvazi/narrative_of_life_of_frederick_douglass_sparknotes.pdfIn PDF document text
    • https://s3.amazonaws.com/kevava/avast_antivirus_free_latest_version.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/tuxiwowitaxofefoseved.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/nifegivexugebefeg.pdfIn PDF document text
    • https://s3.amazonaws.com/winumigutam/coloring_math_worksheets_6th_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/zoluwivebiro/chitralahari_movie_songs_ringtones_free.pdfIn PDF document text
    • https://s3.amazonaws.com/bejeseja/integrated_chinese_level_1_part_1_workbook_simplified_characters.pdfIn PDF document text
    • https://s3.amazonaws.com/nagudo/48690090205.pdfIn PDF document text
    • https://s3.amazonaws.com/gavobawum/kelvinator_la_cuisine_oven_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9CC 5120 bytes
SHA-256: f2df67cb8393e915283818fd6e7f6a2545462096a95d27684461764447f73943
font_01_sfnt_off0000fb50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB50 10612 bytes
SHA-256: a1015740b38a22285de1fc7622dbb434189734c1c2fffc8d6e2febe43435f358

Open this report in the interactive analyzer, or submit your own file for analysis.