Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a8d9219726ab554…

MALICIOUS

PDF

79.9 KB Created: 2021-03-14 06:26:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4ed1a69da607196c5fe8c0d80842d4f SHA-1: d2f0e78dac7a66ae3deb4ec35515cc9110363416 SHA-256: 9a8d9219726ab554c73f1d9dd3e17c37e00f1b7a24c1469593dbf5709960fbd6
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically mentioning invoice or payment language and a callback lure. It also contains a large number of external links, with one pointing to a suspicious domain 'seumenha.ru'. While no scripts were explicitly extracted, the PDF structure and the presence of external links suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=dialectical+behavior+therapy+training+2019
    • https://cdn-cms.f-static.net/uploads/4480174/normal_600c8ca66f8d8.pdf
    • https://cdn-cms.f-static.net/uploads/4387925/normal_602db1955493a.pdf
    • https://pejejuwefosewa.weebly.com/uploads/1/3/4/0/134040570/72bc152df62833.pdf
    • https://fuzidenexusud.weebly.com/uploads/1/3/4/1/134131246/4b6a3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/muxegeza/will_cyberpunk_be_online.pdf
    • https://s3.amazonaws.com/gasodamuza/aruba_switch_3810m_configuration_guide.pdf
    • https://s3.amazonaws.com/tobaziw/76850717772.pdf
    • https://s3.amazonaws.com/jawusawar/nikepujakogi.pdf
    • https://s3.amazonaws.com/faluzotixupi/4th_grade_grammar_review_worksheets.pdf
    • https://s3.amazonaws.com/pujirageg/chiswick_house_school_uniform.pdf
    • http://pifixoga.epizy.com/baraza_la_mawaziri_tanzania.pdf
    • https://s3.amazonaws.com/gawabog/xajudozetub.pdf
    • https://s3.amazonaws.com/sukobogixe/cargo_transport_simulator_1._2_mod_apk.pdf
    • http://lisunamubeso.epizy.com/bangsamoro_basic_law_2020.pdf
    • https://s3.amazonaws.com/jiguwuzobozobaz/wabopunefamewib.pdf
    • https://s3.amazonaws.com/jezaxojipevu/samsung_ak59_remote.pdf
    • https://s3.amazonaws.com/wexoteluwag/allcast_receiver_mod_apk.pdf
    • https://s3.amazonaws.com/lofese/857037865.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2e2.bin
f525c506ffd408cfde7f1ff47ae0f532e8f82e2f032470be4bcb5fab2d24817d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2E2 5800 bytes
font_01_sfnt_off0000f6b2.bin
0793540819165a39b05d43d4d05b64d6e64480059269c9d649f95b660a729c09		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6B2 11452 bytes
font_02_sfnt_off00011cfb.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CFB 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.