Malicious PDF — malware analysis report

Static analysis result for SHA-256 8640357f08109127…

MALICIOUS

PDF

66.7 KB Created: 2021-03-26 05:35:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: f0edbf2f063efa606df7e3421d236647 SHA-1: e6f86eaf6f52b94bf7f0357a0cb42d11f7e7d265 SHA-256: 8640357f081091274eb9552e2a6c021df6a71e01c57b0fa1a7f8bf5c6efd0aa1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded text referencing a 'Craftsman garage door opener' issue, which is likely a lure. A critical heuristic firing from ClamAV identified the file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0'. The presence of an external URI pointing to 'seumenha.ru' further supports the phishing or malware distribution intent, suggesting the document is intended to be delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=craftsman+garage+door+opener+will+not+work+with+remote PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4489411/normal_5fc6d43048941.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481520/normal_5fe1525c8ab7d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468289/normal_6059b740a466b.pdfIn PDF document text
    • http://jerunuju.mypressonline.com/bodybuilding_food_list.pdfIn PDF document text
    • https://cdn.sqhk.co/kusonemap/fgdjasr/15088212976.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418584/normal_6006804ae9353.pdfIn PDF document text
    • https://cdn.sqhk.co/kukelagalefe/hihiimq/80478761084.pdfIn PDF document text
    • https://cdn.sqhk.co/zejizoguzut/ehcPicn/domino_s_pizza_east_republic_road_springfield_mo.pdfIn PDF document text
    • https://cdn.sqhk.co/fufigavaki/KVsgc7z/draw_out_salve_uses.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461516/normal_5ff0f5350c88e.pdfIn PDF document text
    • https://cdn.sqhk.co/gupimupiset/ePRhiJ4/wadakax.pdfIn PDF document text
    • https://cdn.sqhk.co/lijedubejop/Nji9jeR/82698363088.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471691/normal_602c76a124513.pdfIn PDF document text
    • https://cdn.sqhk.co/modonasuje/gihidhe/xubupugad.pdfIn PDF document text
    • https://cdn.sqhk.co/soziwariru/Rijg9hg/police_siren_sound_effect_royalty_free.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470553/normal_5fffcf338ff63.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413578/normal_5fe265bb383bc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbd3c98f-a13a-42f6-bc9b-f4c1f8e5fa0e/samsung_galaxy_s9_plus_used_price_in_pakistan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f7d4fb4-d564-4957-bc2f-cd5cc38a8469/logitech_wave_keyboard_arrow_keys_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae1b2741-20a2-449e-9633-f729f6674dc8/ping_pong_ball_in_java.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/620f7f28-9410-412e-b387-c65c8864ec1f/92684863628.pdfIn PDF document text
    • http://bebovufuvuji.myartsonline.com/45113144069.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA21 5516 bytes
SHA-256: 569049f79b8e410fdf72d06d3c31b52468267d6e6476b10e814e305de5a02df9
font_01_sfnt_off0000dcc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCC5 9384 bytes
SHA-256: e129210f88105700ca2abfb6903a4d95331926a3511728eced40a6d82a0bee05

Open this report in the interactive analyzer, or submit your own file for analysis.