Malicious PDF — malware analysis report

Static analysis result for SHA-256 9485c34f5b0aefba…

MALICIOUS

PDF

79.4 KB Created: 2021-03-22 10:43:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c915e3bde76028235e1e072b43a4a7e3 SHA-1: ea981ca454b759ec91b4bd19526512c88ca913cc SHA-256: 9485c34f5b0aefba0fe794cae097a1bff875a4be8b0c29db09db2c7fe2205696
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The PDF contains a mass of external links, many of which point to PDF files hosted on dynamic DNS services, suggesting a link farm or redirection mechanism. The primary URL, https://seumenha.ru/wix?keyword=benign+tumor+formed+from+glandular+tissue, is likely a lure to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=benign+tumor+formed+from+glandular+tissue
    • https://cdn.sqhk.co/sesekopusoj/TiajbRv/sngpl_bill_calculation_formula.pdf
    • https://cdn.sqhk.co/rekubapapup/Na3Fggc/red_vinyl_ball.pdf
    • https://cdn.sqhk.co/zalenemu/hGxhaje/baby_yoda_dog_toy_meme.pdf
    • https://cdn.sqhk.co/sitosuduf/PNmSjjo/comment_hacker_among_us_mobile.pdf
    • https://cdn.sqhk.co/lituxopevuk/uSyiahf/soguwilojijugubupewis.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zarusorujot.epizy.com/32736755982.pdf
    • http://nolagevupuxuje.epizy.com/5275119763.pdf
    • https://uploads.strikinglycdn.com/files/7934ea60-3f76-4ba1-8cf0-38cb392445c5/40213635561.pdf
    • https://uploads.strikinglycdn.com/files/25cfcb10-5483-48f0-b4a0-79651044f830/how_to_remove_chicken_pox_scars.pdf
    • https://4541bc1c-e35c-4de3-bb44-1f53c3e1a56d.filesusr.com/ugd/68f66e_1b5a19ece87e4418bab9577372ee7c35.pdf?index=true
    • https://def26600-86c9-4442-a738-094ddf2992d1.filesusr.com/ugd/eb5a6a_eb1fd815f60b41bda9b43827350cfb4c.pdf?index=true
    • http://gafazexetoraxik.epizy.com/ginerikotitapufupuniwe.pdf
    • http://kubitilabevovup.rf.gd/enterobacterias_caracteristicas.pdf
    • https://uploads.strikinglycdn.com/files/dda06aee-5e03-499d-bbef-1d73e0fdb3ec/64228497298.pdf
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_ddf7c360698b44b6bf25739b1975182b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7835b3e1-23ce-4917-b31a-bc9c9036c7fe/how_to_set_alarm_on_armitron_sport_watch.pdf
    • https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_72f051d5444e489498d77fc64bd1e6be.pdf?index=true
    • https://34886cf3-15ed-44db-93e8-8979dc7c4cd7.filesusr.com/ugd/ea2c45_9f2eb3b5f2624784976ec021c6325a5d.pdf?index=true
    • https://0ddd2631-58c7-464c-86d0-a5d1d8121c04.filesusr.com/ugd/301b85_f08f5bfcea6f4a16badc0f67ad22f15d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f7af40a4-3e23-4e05-8ff3-9a0f77a40999/chopin_prelude_no_4_piano_sheet_music.pdf
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_2085f8d7c96b4f2880fa1356d1016150.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e857.bin
9d51b33eba7417cba15944447f077b8beb62bf61d252a6734e8476c56ffec385		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE857 5156 bytes
font_01_sfnt_off0000f9c6.bin
2babdae8f46583fbe1a47d04ae034e2723a7c86a6257666e58ee4e7dd85875e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9C6 11752 bytes
font_02_sfnt_off000121c9.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121C9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.