Malicious PDF — malware analysis report

Static analysis result for SHA-256 a683bf6679e7028f…

MALICIOUS

PDF

77.2 KB Created: 2021-03-05 00:18:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 4b6e27e39f286358a4a17f4c770570d2 SHA-1: b3a8ef6cc7b52a958a592d8fcddfc702fdecf900 SHA-256: a683bf6679e7028f3f1a487d0d0009cd43280eee0f6168cb53a6c48d8661e9b4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'seumenha.ru' suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into visiting a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/aws?utm_term=play+script+format PDF link annotation
    • http://lebizifijafaxim.medianewsonline.com/43181016168.pdfIn PDF document text
    • https://cdn.sqhk.co/gobamagedesi/jhwhdgX/youtube_video_upload_stuck_at_99.pdfIn PDF document text
    • http://xuxetosufuzo.getenjoyment.net/washington_state_university_ranking_world.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485823/normal_6019c5a0c4c91.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459325/normal_5fc7a49984c20.pdfIn PDF document text
    • http://gavazugemopemoj.22web.org/amor_y_respeto_en_el_matrimonio_gratis.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413468/normal_602f377a54625.pdfIn PDF document text
    • http://vufajed.getenjoyment.net/bokumagagifafigegewux.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495241/normal_6025c5a1866f1.pdfIn PDF document text
    • http://toxebugusopasur.22web.org/the_cellist_of_sarajevo_audiobook_free.pdfIn PDF document text
    • http://newuwedeza.mypressonline.com/livinigev.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452593/normal_5ff297fa770de.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476148/normal_602d4e2e79609.pdfIn PDF document text
    • https://cdn.sqhk.co/betewulo/KqjbGia/7825779289.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368226/normal_603e2b9c73d7f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://jeborawaleko.atwebpages.com/ancient_celtic_mens_hairstyles.pdfIn PDF document text
    • https://s3.amazonaws.com/lolaritemukole/how_to_rewrite_logs_as_exponents.pdfIn PDF document text
    • https://s3.amazonaws.com/viwoxuz/ar-15_upper_receiver_length.pdfIn PDF document text
    • https://s3.amazonaws.com/sajezife/does_verizon_have_any_new_phone_deals.pdfIn PDF document text
    • http://bibobega.epizy.com/9068755081.pdfIn PDF document text
    • https://s3.amazonaws.com/levovod/android_graph_library_github.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f032.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF032 5264 bytes
SHA-256: 2a8906b7f5c0f08c8213ae816a518f91b4bce4ece1777c805cb5b69c92887ecf
font_01_sfnt_off00010210.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10210 10652 bytes
SHA-256: feb99930d2a975c9fc1504ecd5b74ebfbaebbe4d8451cf67e1580b4b83e83cc0

Open this report in the interactive analyzer, or submit your own file for analysis.