Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5fe2532b24fd985…

MALICIOUS

PDF

77.6 KB Created: 2021-03-27 23:18:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 23d3723cbaf709a25ddeb8f68224a54c SHA-1: ba592ee5501a9f3fda60dc885e313a7700ed0e89 SHA-256: c5fe2532b24fd98591b18c134d59a944ac8cc7d99096bb548a231273e3c02fcf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external links, with a primary suspicious URL pointing to 'seumenha.ru'. The PDF structure suggests it's designed to appear as a search result or informational content to mask malicious links, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=mt+carmel+park+ohio
    • https://cdn-cms.f-static.net/uploads/4384304/normal_6035a604cf8f7.pdf
    • https://static.s123-cdn-static.com/uploads/4481994/normal_5ff76a6d026ea.pdf
    • https://cdn.sqhk.co/zusisoko/bvjfGe6/hyrule_warriors_characters_wii_u.pdf
    • https://cdn.sqhk.co/tumowara/giie0ih/48364384339.pdf
    • https://cdn.sqhk.co/votojuxosaf/hdjUjeE/cheap_flights_to_san_francisco_from_birmingham_uk.pdf
    • https://cdn.sqhk.co/bipuzojafa/gjiKjdq/jujarezavunudapiv.pdf
    • https://cdn-cms.f-static.net/uploads/4426416/normal_60171ac781b4a.pdf
    • https://static.s123-cdn-static.com/uploads/4485004/normal_5ff585b2b3f5b.pdf
    • https://cdn.sqhk.co/sarunasol/jR0jghc/vodifupuvafol.pdf
    • https://cdn-cms.f-static.net/uploads/4474218/normal_6014cb42524f2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tuzakifezara/branding_iron_font_free.pdf
    • https://uploads.strikinglycdn.com/files/ae878597-d236-472c-9565-59ff2c019788/ms_7641_ver_4.0_motherboard_manual.pdf
    • https://s3.amazonaws.com/xutomoxu/55018352394.pdf
    • https://s3.amazonaws.com/kefefetafij/97397128634.pdf
    • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_3fcc05964abd4554a96c2411fa796f6b.pdf?index=true
    • https://s3.amazonaws.com/xufaxoferugod/real_exponents_and_exponential_functions_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/7e49f453-3fc8-4939-8e03-ca31d7fa450f/xibexigemukisikuliwafuxo.pdf
    • https://s3.amazonaws.com/mokixetat/18687974476.pdf
    • https://7980b0ff-2efe-48f4-a442-6c87bca80713.filesusr.com/ugd/9bd8c3_78ff28f5589b41fcb162f4c1369f8427.pdf?index=true
    • https://569961a5-e6b5-462d-8b38-7193d5e7b20b.filesusr.com/ugd/a37a2e_d1f7b1feaecb4783b4b415a45226cfa6.pdf?index=true
    • https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_f7a02a4339fb442a905a1f977b3e27ed.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c0c114e1-6232-4b3d-ab82-75d9fdcaa393/at_lp60_belt_setup.pdf
    • https://uploads.strikinglycdn.com/files/f6777e6d-3642-4ff2-90a3-38e8d8da72fc/wheres_waldo_free_game_no_download.pdf
    • https://73c25812-7308-4b32-b985-10e2a25710ca.filesusr.com/ugd/5b604d_c8a1660d014d4e15b6c8c56bd3415f3f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/057941fc-4ab8-434a-b136-7db0ee0eaa5d/92594166171.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2ae.bin
8cfa55b5b6eeb99eb0e0ced699e553a5e57bfce5adc212f60108ab2d72e785d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2AE 5064 bytes
font_01_sfnt_off000103c7.bin
98b5f7adc8a55e74fe7507ffbed4c5e5e191461b4036d0d9c7d36ebd367c0b8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103C7 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.