Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6c17bbe6e839cb4…

MALICIOUS

PDF

64.9 KB Created: 2021-01-29 19:49:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: e36f8a32f5b9c99e8f1d399dc3a966f8 SHA-1: 5820d4d06f300035a1af604fa49d7cd4bf9a7b98 SHA-256: b6c17bbe6e839cb45611c18bc97923eec8418902b7a670f35d4db058001de6cb
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF document was flagged by ML classifiers and ClamAV as malicious, with heuristics indicating a remote-support tool lure. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'Qt', suggesting it was generated by a tool. The presence of external URIs, including suspicious domains like 'seumenha.ru' and 'opit.space', indicates potential phishing or malware download attempts. No scripts were extracted, but the overall context points to a social engineering attack aiming to trick the user into executing a malicious payload or granting remote access.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=troy+bilt+mower+manual+pdf PDF link annotation
    • http://opit.space/41810097042lk2m9.pdfIn PDF document text
    • https://cdn.sqhk.co/virurewev/exVnfno/modern_house_city_map_minecraft.pdfIn PDF document text
    • http://natur-green.fun/art_collection_color_by_number_pokemondgrbw.pdfIn PDF document text
    • http://ourfutures.space/millionaire_mindset_book_summaryqytb2.pdfIn PDF document text
    • http://discount50it.pro/guvizujujewogacgpc.pdfIn PDF document text
    • https://cdn.sqhk.co/benibavagoge/ibjbKhd/teamviewer_quicksupport_apkpure.pdfIn PDF document text
    • http://itravelgr.com/the_sims_4_cheats_skillsnbp61.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zuvovoxigumuz/nanimef.pdfIn PDF document text
    • https://s3.amazonaws.com/ganubifirigevi/icinga2_api_cheatsheet.pdfIn PDF document text
    • https://s3.amazonaws.com/seriposuj/fonitezosovexujake.pdfIn PDF document text
    • https://s3.amazonaws.com/zarusegibitumet/12988633676.pdfIn PDF document text
    • https://s3.amazonaws.com/zizene/41155597589.pdfIn PDF document text
    • https://s3.amazonaws.com/tetofamuxulil/maths4everyone_composite_functions_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/xakajoziwibi/brassed_off_music.pdfIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/9119602102.pdfIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/best_smoothie_recipe_book_2018.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c201.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC201 5292 bytes
SHA-256: 23f56163fca1e31bb810e6487b2452bf3d239f9556b3b1485db48ca4467e8dbe
font_01_sfnt_off0000d400.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD400 10288 bytes
SHA-256: 52fb26dcc719c6d14b0a2f004d50cf47d0a722e33b0d0b242a866fff06a32702

Open this report in the interactive analyzer, or submit your own file for analysis.