Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccc7fa7b52ec762d…

MALICIOUS

PDF

72.4 KB Created: 2021-04-13 09:09:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 434e18f00b1d061740c95cd05fef95b3 SHA-1: a332f62e8f77c1697531e947a228dcb73fbdb971 SHA-256: ccc7fa7b52ec762d500ec776c4748b2b0cb1a83f144058ddaa206530bd2a12fc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://seumenha.ru/strik', which is likely used to redirect the user to a phishing or malware distribution site. The document body is heavily obfuscated, but the presence of external URIs and the overall detection suggest a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=html5+new+tags+footer PDF link annotation
    • http://vuzeliligovitu.iblogger.org/assembly_language_and_computer_organization.pdfIn PDF document text
    • https://cdn.sqhk.co/motanunika/hjiduge/kegozokula.pdfIn PDF document text
    • https://cdn.sqhk.co/mujawiru/hhzjFAn/tiki_taka_the_classic_soccer_tips.pdfIn PDF document text
    • http://soxutabuxupene.22web.org/elemen_penilaian_bab_8_akreditasi_puskesmas.pdfIn PDF document text
    • http://sedugarawale.22web.org/22236742736.pdfIn PDF document text
    • https://cdn.sqhk.co/rurokusulos/0jgu8Fa/90794506319.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xeviwunukogula.epizy.com/blouse_designs_images_download.pdfIn PDF document text
    • http://wuzuruwevirelu.rf.gd/79392615846.pdfIn PDF document text
    • https://s3.amazonaws.com/vuraradaso/borifatizazatozifa.pdfIn PDF document text
    • https://s3.amazonaws.com/xidazeze/bounce_tales_game_app.pdfIn PDF document text
    • https://s3.amazonaws.com/wutogugej/project_follow_up_template_xls.pdfIn PDF document text
    • https://s3.amazonaws.com/tibitexil/blank_cv_template_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/lolijexejomak/formation_auxiliaire_de_vie_scolaire_lyon.pdfIn PDF document text
    • http://lelofenejoziza.epizy.com/wise_child_angela_carter.pdfIn PDF document text
    • http://jekidosokun.epizy.com/template_creative_cv_free.pdfIn PDF document text
    • http://kagukolanafifod.rf.gd/eg_6500_cl_honda_generator_oil.pdfIn PDF document text
    • https://s3.amazonaws.com/fikuvine/36538182046.pdfIn PDF document text
    • https://s3.amazonaws.com/faxaxos/monthly_cash_flow_forecast_template_excel.pdfIn PDF document text
    • http://buvodadixasiz.epizy.com/68747911705.pdfIn PDF document text
    • https://s3.amazonaws.com/kisimujuk/cole_nussbaumer_knaflic_storytelling_with_data.pdfIn PDF document text
    • https://s3.amazonaws.com/xalexojaxipud/dekajulifesuxino.pdfIn PDF document text
    • https://s3.amazonaws.com/zukogi/fleetwood_mac_landslide_tab.pdfIn PDF document text
    • https://s3.amazonaws.com/xifabilejilab/53276697156.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de3b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE3B 5264 bytes
SHA-256: c2be9f9a9c14502653f7f70edfa46e7192b244a4a658abaf390edf845d91e580
font_01_sfnt_off0000f01f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF01F 10704 bytes
SHA-256: 6dc93f1685eca20af53b6bd0e4647cd6c64e315c6a3ed5e3391fdb79d54495e5

Open this report in the interactive analyzer, or submit your own file for analysis.