Malicious PDF — malware analysis report

Static analysis result for SHA-256 886276e531c77a12…

MALICIOUS

PDF

66.9 KB Created: 2021-03-13 21:51:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2e25f17adc8b3619fb9cdde16131b035 SHA-1: ed800a8fee16dd653ee7699f74f2f6ae20eb2392 SHA-256: 886276e531c77a12a3eed6a46bdc30f98debe6763f8f79eb2c76a65b4f86d161
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains multiple embedded URLs, with the primary one being 'https://seumenha.ru/wix?keyword=balance+collection+leggings+capri', suggesting a lure for phishing or malware download. Although no scripts were explicitly extracted, the PDF structure and embedded URIs indicate a malicious intent to redirect the user to a potentially harmful external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=balance+collection+leggings+capri
    • http://tivuximuliku.mygamesonline.org/is_the_hobbit_trilogy_worth_watching.pdf
    • https://cdn.sqhk.co/mekurapiw/Eg6hff3/sakodobe.pdf
    • https://cdn.sqhk.co/ranetixeba/KjhmjcI/22147018399.pdf
    • https://cdn.sqhk.co/zutomina/iiiviOO/27602053106.pdf
    • https://cdn.sqhk.co/soxuwutitaw/gWhbgL5/growtopia_wiki_surgery.pdf
    • http://tavaxibewoposo.iblogger.org/repanolavebumori.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_4d86179c9a7f422bacac3aba78034c71.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d148ac79-40e7-4285-8b57-a28c13d89ade/womap.pdf
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_50c06c5f78e543f6b1d831e3fa1eda4a.pdf?index=true
    • https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_31247f0501fe4c028dc7ed03a8378a4b.pdf?index=true
    • http://liwumulexajuvi.epizy.com/chi_mushi_chi_nepali_song.pdf
    • http://muguvap.epizy.com/can_you_day_trade_ethereum_on_robinhood.pdf
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_33319f1144a74e7d9bc38f816606b7f7.pdf?index=true
    • http://desujiruvomeb.myartsonline.com/tipos_de_alveolitis.pdf
    • http://kitasiru.epizy.com/momolodigakamup.pdf
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_2eb8fd608cb74ab7a3d49b692534bfe6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9f3e404a-2883-4d8b-b3bf-458aee52726f/the_land_of_stories_book_3_word_count.pdf
    • http://wumafopid.onlinewebshop.net/kumukomoba.pdf
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_3aded18e210c4526952575ba6377b00c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cef5750f-9023-4f4c-869f-505155910896/dubiwuwusokojek.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c7c0.bin
5d282c07ed2da74c033f009f10bf40c720d39bd6aca092cbf2725417ee2fb6a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7C0 5148 bytes
font_01_sfnt_off0000d957.bin
a0036047908166a5eac8a1bd86977ba3f42b482630dc55ba670f25331a8d2065		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD957 10400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.