Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4d92b186fc340cb…

MALICIOUS

PDF

74.1 KB Created: 2021-03-17 19:25:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 83828c8d76b3f516f55d3cf25b42350e SHA-1: d60d98019768c2a84dd27320120c1cb02f98907b SHA-256: a4d92b186fc340cb989e5779e77af4d73f9786c1b221c2aac6ead8b8de169902
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating phishing and Trojan characteristics. An external URI pointing to 'seumenha.ru' was extracted, suggesting a potential phishing lure related to a calendar. While no scripts were directly extracted, the PDF format and the nature of the URL suggest it could be used to deliver a malicious payload or redirect to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=telugu+calendar+2020+pdf+october
    • http://zumubexupon.22web.org/cheat_engine_6._8._3_apk.pdf
    • https://cdn.sqhk.co/wituruxa/ibpgZ5a/limobejog.pdf
    • https://static.s123-cdn-static.com/uploads/4472788/normal_5fef40571576c.pdf
    • https://cdn.sqhk.co/bedepekemat/1khczjS/vixoj.pdf
    • https://static.s123-cdn-static.com/uploads/4489429/normal_5fc615de05c33.pdf
    • https://cdn-cms.f-static.net/uploads/4500208/normal_6028757377b9f.pdf
    • http://sikovagaxuwe.22web.org/24213355412.pdf
    • https://cdn.sqhk.co/soxuvezosapa/hhyOpTJ/planet_fitness_locations_los_angeles_ca.pdf
    • https://cdn-cms.f-static.net/uploads/4472213/normal_60177c568544c.pdf
    • https://static.s123-cdn-static.com/uploads/4405642/normal_5ff657332a5cc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_222ec4c4e0634ee8b23d55451a181c31.pdf?index=true
    • https://s3.amazonaws.com/pasawexawinogad/que_es_bienestar_social.pdf
    • https://uploads.strikinglycdn.com/files/805d0fd2-13bc-45c6-8cf5-aa5284d7230e/nijujavetu.pdf
    • https://s3.amazonaws.com/wujapu/2585482646.pdf
    • https://s3.amazonaws.com/sosupejuxofedo/xagarulixedovu.pdf
    • https://uploads.strikinglycdn.com/files/8e8a1150-7ceb-4bf1-aae3-f4834547105c/how_do_you_change_the_currency_on_excel.pdf
    • http://difugarulid.epizy.com/vaponuwubabovagajo.pdf
    • https://uploads.strikinglycdn.com/files/caa06a7c-064e-4a48-b315-f3fd3afb8547/wejaritewakoze.pdf
    • https://s3.amazonaws.com/wanasuvedigo/fazegewiz.pdf
    • https://cd9ed9ec-87d1-42be-9198-0b2de6c1db4d.filesusr.com/ugd/158fb9_b6825f4ffc1e49f0b8aa1c132518e766.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6f6.bin
699e8bd6b44d66618ca56ab898caec55b820d1d3618ee508e35fec0e129ce01b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6F6 5340 bytes
font_01_sfnt_off0000e920.bin
16315034cf13b343258c9d0cbfa7484af9f0aea61fda1f6c7291ea12b5251727		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE920 10412 bytes
font_02_sfnt_off00010cdd.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CDD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.