Malicious PDF — malware analysis report

Static analysis result for SHA-256 c39b8eebcfde3269…

MALICIOUS

PDF

78.7 KB Created: 2021-03-27 18:07:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 040c3d6ca5efaa557cfb64709a29a602 SHA-1: c5eb3cc9664c083d2f3b2624f6acb983531be733 SHA-256: c39b8eebcfde32691a25f9de3d298d752a76ebac5368153905aad8a3c0595562
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with at least one, 'https://seumenha.ru/award?keyword=attestation+d+h%25C3%25A9bergement+pdf+impot', appearing to be part of a phishing lure. The document body, though heavily obfuscated, suggests a theme related to 'Attestation d'hébergement pdf impot', likely a pretext to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=attestation+d+h%25C3%25A9bergement+pdf+impot PDF link annotation
    • https://cdn.sqhk.co/woluzadeviv/TxjihdD/stick_man_gifts.pdfIn PDF document text
    • http://raifaisentapp.online/38236328603hekbr.pdfIn PDF document text
    • https://cdn.sqhk.co/pujazojiwixi/Chehchc/53199711167.pdfIn PDF document text
    • http://fatunatet.getenjoyment.net/41737884627.pdfIn PDF document text
    • https://cdn.sqhk.co/nanubebebot/8zKDjgV/basketball_battle_apk_mod.pdfIn PDF document text
    • http://lnstagram-helps-contact.com/9039947847ubn62.pdfIn PDF document text
    • https://cdn.sqhk.co/linewebozid/vjgzeih/jexufofeboger.pdfIn PDF document text
    • http://gapilojazixo.getenjoyment.net/dogesaridor.pdfIn PDF document text
    • http://elerctum.org/telecharger_alphabet_grecdkvv3.pdfIn PDF document text
    • https://cdn.sqhk.co/fuxuduxexi/iidvtih/screen_time_apple_ignore_limit.pdfIn PDF document text
    • http://thrivewebs.com/75925363422vfpg5.pdfIn PDF document text
    • http://tryici.xyz/4118789232hs6nb.pdfIn PDF document text
    • http://kugaraginoja.mypressonline.com/pelibuwemu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xoxaneral/hoards_station_sale_report.pdfIn PDF document text
    • https://c5b3e1fc-3b55-407d-a8d9-2bfa6c9015c1.filesusr.com/ugd/6df244_b2dfe250ffad48c2af1e6730963406ed.pdf?index=trueIn PDF document text
    • https://92ddf5cc-4ce7-4caf-b117-8241c553a727.filesusr.com/ugd/42bae0_2e4587ed86e94d66a7ee652bd27b315d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tanikanaw/53793241090.pdfIn PDF document text
    • https://s3.amazonaws.com/gopifu/55963810887.pdfIn PDF document text
    • https://s3.amazonaws.com/rikolesafuwofar/star_wars_battlefront_2_2005_original.pdfIn PDF document text
    • https://s3.amazonaws.com/bamepofewalada/kojutawifaluwufabib.pdfIn PDF document text
    • https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_bfec9eca54d5482fb4062652a61faa92.pdf?index=trueIn PDF document text
    • https://0c6b7a74-1ca0-41da-943c-c268a208a416.filesusr.com/ugd/fef373_d46a4a831ed040bba607429f46c0403e.pdf?index=trueIn PDF document text
    • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_72343516d2414d538df3ad3b1e33d487.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f171.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF171 5692 bytes
SHA-256: fe2f30125abbd417d36ef8235a92b88163e4bdb114eb6629a3fe801c6050eb20
font_01_sfnt_off00010459.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10459 12200 bytes
SHA-256: 3742a398761980ad334c23270046a83589b764f411448059dd992dc6dc4aedb5

Open this report in the interactive analyzer, or submit your own file for analysis.