Malicious PDF — malware analysis report

Static analysis result for SHA-256 98f513eecf34b46a…

MALICIOUS

PDF

289.8 KB Created: 2021-03-25 06:40:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 86cc5470ed9077822b6dfc72e956b5f2 SHA-1: 2b2e12b4b6439550e92f998c2097d64c6b65e8c8 SHA-256: 98f513eecf34b46acec228c77f7fdebd546284743418cc47f34d7d8d032c7ad9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, 'seumenha.ru', which is likely used to deliver a secondary payload or conduct phishing activities. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically and potentially used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9793

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=book+of+runes+blum
    • http://bafiselavanebep.mywebcommunity.org/fovozitudiwajerezobowi.pdf
    • http://summ-green.fun/barojadaderirunwauh.pdf
    • https://cdn-cms.f-static.net/uploads/4481170/normal_5fd9e3c9a8d78.pdf
    • https://cdn.sqhk.co/sirejeforox/jhc1ic9/89516044634.pdf
    • http://wokulorumal.iblogger.org/problem_solving_activities_for_elementary_students.pdf
    • https://cdn.sqhk.co/jafetegupam/geiiig9/69107819688.pdf
    • http://rubka.space/muturefijufijumegokr3hp7.pdf
    • https://cdn.sqhk.co/vasozaponem/gKjeicd/craftsman_style_house_plans.pdf
    • http://boevoenlp.com/sovotijoxapelefatupazonskm2.pdf
    • http://wifunagidoli.mypressonline.com/examples_of_air_borne_diseases_in_plants.pdf
    • https://cdn.sqhk.co/jiluputumusi/7Ajc57v/fear_the_walking_dead_episode_1_watch_online.pdf
    • http://tersq.fun/59420488866fnck1.pdf
    • https://static.s123-cdn-static.com/uploads/4412415/normal_5ff0f7d1d5544.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://solarujarinobo.myartsonline.com/shackleton_book.pdf
    • https://s3.amazonaws.com/divikufifir/puzzles_brain_teasers_with_answers.pdf
    • http://wonetone.rf.gd/amsterdam_transit_map.pdf
    • https://s3.amazonaws.com/gixawetopoli/chimera_jailbreak_ios_12.pdf
    • https://s3.amazonaws.com/pasawexawinogad/luwomifuw.pdf
    • http://dedamedasobime.epizy.com/animated_cartoon_video.pdf
    • http://dapufojutujat.atwebpages.com/71447908464.pdf
    • http://xobefojeb.rf.gd/74334262652.pdf
    • https://s3.amazonaws.com/sinamozagemoger/bemuvovufina.pdf
    • http://kupobazixivev.rf.gd/free_reading_comprehension_worksheets_for_second_grade.pdf
    • https://s3.amazonaws.com/supefujoxopubu/18796016322.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d5b.bin
b9d4d254ce3feca62760b9544af7baa9bc8348bc6a82aadecc60cab676d79365		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D5B 262892 bytes
font_01_sfnt_off00041ac2.bin
8fabd1ac3ecfbc0ae70274937158dc9f4f13de645c25c21df47c3a1adda125dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41AC2 4956 bytes
font_02_sfnt_off00042b54.bin
9166aa1fa7e665089be886e831b960f09559ed3854e1901ff328bb03c6843fdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x42B54 12416 bytes
font_03_sfnt_off00044b01.bin
71ea37af35dccaa6f3d2d7b2a0c90e30beb2f13b5c530fdb67359643dcafd843		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44B01 14548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.