Malicious PDF — malware analysis report

Static analysis result for SHA-256 b69b7a2687ef8f84…

MALICIOUS

PDF

80.7 KB Created: 2021-03-31 10:09:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1dac79fbd0008d30a2afd7b88ea16860 SHA-1: 7369776108f5f5e493e0ffa2a39ff09a75aae080 SHA-256: b69b7a2687ef8f845ebe66c09cb872d62078bff0798b865288137aaba1463e17
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to 'https://seumenha.ru/award?keyword=ammophila+arenaria+pdf', which is likely used to deliver a malicious payload or redirect the user to a phishing site. The presence of multiple unknown URLs further supports the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=ammophila+arenaria+pdf
    • https://cdn.sqhk.co/kekotenonaxu/tN2Q0jg/jasanugi.pdf
    • https://dofipoxadule.weebly.com/uploads/1/3/4/3/134314370/degak_lofur_jilibibomege_jusifotorino.pdf
    • https://cdn.sqhk.co/sunomedude/uwii7OL/minecraft_pocket_edition_lite_free.pdf
    • https://static.s123-cdn-static.com/uploads/4384822/normal_5ff1b3ef23306.pdf
    • http://topvideo.design/lalogetitukafagaaf68l.pdf
    • https://cdn-cms.f-static.net/uploads/4422908/normal_605600d869974.pdf
    • https://vixugusimuxomuj.weebly.com/uploads/1/3/0/9/130969476/xejiruwovijir_fuwesur_mezigaf_tugedoke.pdf
    • http://golden-bridge.pro/bofikulawudox1bmvp.pdf
    • https://cdn.sqhk.co/juwafajem/giKgiii/95351104766.pdf
    • http://bamejudodenor.iblogger.org/bumib.pdf
    • http://voiprormul.xyz/global_islamic_finance_report_2017sy82m.pdf
    • https://cdn-cms.f-static.net/uploads/4366313/normal_5fd81d8dddc08.pdf
    • http://meetsalon.xyz/char_broil_air_fryer_turkey_recipeglhxz.pdf
    • https://pigunakates.weebly.com/uploads/1/3/4/6/134628742/24ef14c5bd.pdf
    • https://static.s123-cdn-static.com/uploads/4412173/normal_5ff49ab2c6377.pdf
    • https://cdn.sqhk.co/sozedikepasu/d3hbwmb/nocturne_c_sharp_minor_piano_sheet.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/87f11119-df3b-47be-bb85-fe76642b5989/cant_get_pilot_lit_on_gas_fireplace.pdf
    • http://renodiwug.epizy.com/vapafitaginupamipuzoda.pdf
    • https://uploads.strikinglycdn.com/files/0930babb-d5b1-477c-bdbb-b846b1c3e5ef/can_you_connect_monster_illuminessence_led_strips.pdf
    • http://gevitejivojo.rf.gd/abbyy_transformer_2._0_serial_key.pdf
    • https://uploads.strikinglycdn.com/files/811cc340-e2c2-4534-a36b-4dd1af0fefac/how_to_do_day_trading_without_25k.pdf
    • http://jasosuwer.epizy.com/ipu_b_tech_form.pdf
    • https://uploads.strikinglycdn.com/files/719c792d-9239-4311-a178-a26db97a312a/shakespeare_sonnet_18_context.pdf
    • http://kamabutexukawiv.rf.gd/25019165555.pdf
    • https://uploads.strikinglycdn.com/files/e3f433e4-8329-4c77-becd-897eb45cff14/zawasudevigitajugi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6e0.bin
96451c43044eb999a78079c93730dcdba0642c3963874dcb8c3030fb00c2de0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6E0 5092 bytes
font_01_sfnt_off00010800.bin
e42febd12ef6cc0a170ef7d920d33bed653fbbb8cfecd275bb67f23d36569d16		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10800 13972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.