Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1a1065e1c628427…

MALICIOUS

PDF

80.6 KB Created: 2021-05-20 11:28:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5da1de1495145bf37729a4cd73ce2dc8 SHA-1: 2cae65cf0c304067b58ca46a6b54966ef19766db SHA-256: b1a1065e1c628427b608066ddf89dfc387b65fe7f478df2cccb1c0ddc7fe8abd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL pointing to 'seumenha.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains text related to 'gta vice city save game files', suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=gta+vice+city+save+game+files
    • https://static.s123-cdn-static.com/uploads/4501233/normal_5ff30f43652d3.pdf
    • https://cdn-cms.f-static.net/uploads/4500678/normal_6018165199ac7.pdf
    • https://static.s123-cdn-static.com/uploads/4446390/normal_5fee94b42db37.pdf
    • https://cdn-cms.f-static.net/uploads/4477156/normal_6067ec933a9ca.pdf
    • https://cdn-cms.f-static.net/uploads/4376854/normal_60693e70e2c46.pdf
    • https://cdn-cms.f-static.net/uploads/4445107/normal_5fd7dbbca63d6.pdf
    • https://cdn-cms.f-static.net/uploads/4447087/normal_5fdc739b79183.pdf
    • https://cdn-cms.f-static.net/uploads/4415061/normal_60495252a67a2.pdf
    • https://cdn-cms.f-static.net/uploads/4485172/normal_604fed8a64056.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fedufiporara/a_partir_de_que_edad_se_puede_tomar_proteinas.pdf
    • https://s3.amazonaws.com/lerezazo/biafra_news_app_apk.pdf
    • https://s3.amazonaws.com/feliso/wagner_250_paint_sprayer_replacement_parts.pdf
    • https://uploads.strikinglycdn.com/files/c13e1feb-abaa-4181-b5f3-0597f384543f/thinkorswim_ipad_app_tutorial.pdf
    • https://s3.amazonaws.com/xeponodij/47441620529.pdf
    • https://s3.amazonaws.com/bivanud/89429393777.pdf
    • https://s3.amazonaws.com/kikunojulejuj/xepuzoxiteduzu.pdf
    • https://s3.amazonaws.com/telasebisu/wopavefi.pdf
    • https://uploads.strikinglycdn.com/files/08a7c063-b970-44f0-aefd-df7cd5aae9fb/harry_potter_and_the_philosophers_stone_literary_analysis.pdf
    • https://uploads.strikinglycdn.com/files/d2678c02-ce82-496b-acb1-3aee2cbce765/libro_de_historia_quinto_grado_pagina_162_y_163.pdf
    • https://uploads.strikinglycdn.com/files/37085aab-d4f2-4a21-82b2-27f6051d5d5b/5322421323.pdf
    • https://s3.amazonaws.com/penale/tiwovolixosubuwejixisen.pdf
    • https://uploads.strikinglycdn.com/files/be265c23-d40f-4ab3-9626-02ee8b90dc61/59004562251.pdf
    • https://uploads.strikinglycdn.com/files/22139750-7b83-43f6-8a9d-31e39718ab4f/15739166491.pdf
    • https://s3.amazonaws.com/bulikowexunepov/59269863068.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5e4.bin
c215fcd02e3bb70d9c2c70a21b7bd6492384d0288db38e9212b2ef92a5038e45		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5E4 5296 bytes
font_01_sfnt_off0000f7f6.bin
d9d471e8215a66e741d532d6fa4178aabaa2f1031447cf11043fb6bcbe26f770		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F6 11492 bytes
font_02_sfnt_off00011f34.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F34 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.