Malicious PDF — malware analysis report

Static analysis result for SHA-256 99673b11c9c91566…

MALICIOUS

PDF

79.8 KB Created: 2021-04-15 15:24:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: f5ef7d096a3e18e2e5dd8cecdb7bb27e SHA-1: 2113777db2d9f148d17c681f1249f4fa3e1a9fb7 SHA-256: 99673b11c9c915662a54ab98a973e66a1879edf4e14008f10a4666d5a0cf0668
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains numerous embedded URLs, with a primary one pointing to 'seumenha.ru', suggesting a redirection to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to car starting problems, aligning with a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=2010+chrysler+town+and+country+starting+problems PDF link annotation
    • https://cdn.sqhk.co/bubesuzax/hiBBvxr/city_car_racing_3d_lite_mod_apk.pdfIn PDF document text
    • http://pumorux.medianewsonline.com/80948832329.pdfIn PDF document text
    • https://cdn.sqhk.co/supopareso/cuhhogh/vitesifizugatemab.pdfIn PDF document text
    • http://fasoxuxesatilu.sportsontheweb.net/xokajesapesotijef.pdfIn PDF document text
    • http://mekujoviwe.mypressonline.com/bakery_products_list.pdfIn PDF document text
    • https://cdn.sqhk.co/kibutonap/ezhcpgg/copper_recycling_prices_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/dedejosewor/ihGXc1z/dark_raider_apk_obb.pdfIn PDF document text
    • http://wogivodugakovek.mygamesonline.org/50015461950.pdfIn PDF document text
    • https://cdn.sqhk.co/jagakutojut/YjhoQcm/marvel_realm_of_champions_release_date_global.pdfIn PDF document text
    • http://xawegap.mywebcommunity.org/lafigojasoda.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d7ecf8d-56de-4784-b39a-4d8cd6773c06/najabemitutavonitotad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f873a913-5db9-4b6f-ac91-42e23300584e/what_is_the_simplified_form_of_44_50.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0fa3e28-1f24-4b26-8f0c-cc4201eea19a/13907459012.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9ca8bcf-c126-4240-bd2a-d32f243cb736/nudazuzifuzifilenubopavo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73298498-07d3-4447-b662-411540e68351/jakekeke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ce82993-b8a3-43f0-9466-1bf1987d3ecf/mushoku_tensei_rudeus_parents.pdfIn PDF document text
    • http://pupagerirawax.myartsonline.com/40284271355.pdfIn PDF document text
    • http://wowutuzineko.myartsonline.com/network_science_albert_lszl_barabsi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb1dbd03-9e82-462c-b43a-36c0da23a1d9/61934521457.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b53e4c1d-ff69-4c45-a2c3-3fb2ca6bcaf3/how_to_create_cracked_minecraft_servers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c7eb122-c4b8-4350-9e00-96ce3513b079/33283025228.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c9888d5-a14f-43c2-80b3-619481dd0934/fevaba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95bbf43a-10ec-46df-b6fe-f368a5857236/4746292945.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d566c86d-f642-4ba1-868b-f74cddb3463a/how_to_turn_off_a_firex_smoke_alarm.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93ad79b2-7d02-483c-93cd-42e40c72ee42/why_does_my_surround_sound_keep_cutting_out.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87eb6ab7-ee87-4ced-9307-622db38bf60e/how_can_we_prevent_social_engineering.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d59015d-050f-4a3f-90e7-36fbfa0c6f94/what_is_evidence_blacks_law_dictionary.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f80c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF80C 6052 bytes
SHA-256: 1ea3bbba0fc9138f34b521ddd279b5b681bdb9dd3284538cc520156802a1875b
font_01_sfnt_off00010c95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C95 10828 bytes
SHA-256: d20c47a6ca27ebde811f0c4d9eea9b8b5dc4cd1037816ec45b70a68f88cf4df4

Open this report in the interactive analyzer, or submit your own file for analysis.