Malicious PDF — malware analysis report

Static analysis result for SHA-256 9636b6bd6f604eb5…

MALICIOUS

PDF

79.5 KB Created: 2021-03-28 23:54:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3d9cd7565813eb36da1ce97ec06f4bd7 SHA-1: 7fe9b74a54ac8f1410fa06d2fe99f899cad54516 SHA-256: 9636b6bd6f604eb5f9f7b27a981247b073c82c7521c3a3c27a62b272c5b2b29e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://seumenha.ru/wix?keyword=newegg+military+discounts` suggests a phishing lure related to discounts. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are commonly used to redirect users to malicious sites for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=newegg+military+discounts
    • https://cdn-cms.f-static.net/uploads/4408987/normal_6023e4edc6058.pdf
    • http://copytoshka.ru/81977250827fnvsw.pdf
    • http://topcreditmonitoring.info/51619203162ncbcs.pdf
    • http://sethel.xyz/728777852111zvlq.pdf
    • https://cdn-cms.f-static.net/uploads/4408719/normal_601187f15e759.pdf
    • http://yandex-delivery.cc/69564582361xofvu.pdf
    • http://legrand-spb.ru/salt_and_sanctuary_mage_guidefc9is.pdf
    • https://cdn-cms.f-static.net/uploads/4505096/normal_605cd75d2352b.pdf
    • http://copyrightprivacy.site/que_medios_de_comunicacion_hay_en_venezuelauk3qj.pdf
    • http://fibilif.iblogger.org/voxalurajonegurafat.pdf
    • http://mif-smeh.space/facebook_3d_photo_depth_map_photoshopmjusa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/gupawupigawono/kufigigitabavej.pdf
    • https://s3.amazonaws.com/ritoma/my_favorite_things_piano_solo_sheet_music.pdf
    • https://s3.amazonaws.com/minaxigevani/angular_5_version.pdf
    • https://s3.amazonaws.com/wuvepilamamuse/ximurefikuwarojug.pdf
    • https://s3.amazonaws.com/davawina/volume_word_problems_worksheet_8th_grade.pdf
    • https://s3.amazonaws.com/zobuwubedak/tronical_tune_charger.pdf
    • https://s3.amazonaws.com/tarajix/jira_api_report.pdf
    • https://s3.amazonaws.com/wixamupelinere/dujixebigekuwupotokosix.pdf
    • http://tulutubuvidimo.epizy.com/vujar.pdf
    • https://s3.amazonaws.com/mamibis/martyrs_of_marriage_movie.pdf
    • https://s3.amazonaws.com/nunakixuma/cracking_the_product_manager_interview.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec63.bin
1a5fe58a3f22e142d99fff071032a3430a56d45617026c133988c09e0dfa7fde		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC63 5304 bytes
font_01_sfnt_off0000fe68.bin
9a4f515acc78b71feac28901b40dd97094f95cb52510872b818eb6bc86eb8d89		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE68 10460 bytes
font_02_sfnt_off00012239.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12239 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.