Malicious PDF — malware analysis report

Static analysis result for SHA-256 d81ee2ff40ef4d06…

MALICIOUS

PDF

81.2 KB Created: 2021-03-19 10:42:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c22deedfd64de54d3f91ff58e518e897 SHA-1: 22be0975fdbf1f99745def3975b2de85d56e185f SHA-256: d81ee2ff40ef4d06acfcfc8cce65a89cb675ef7c5beac8ba2c494edf58bea89b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'seumenha.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains text related to the Vietnam War, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=long+term+effects+of+vietnam+war+on+soldiers
    • http://abwaab.su/american_woodmark_catalogwotu7.pdf
    • https://sarisakela.weebly.com/uploads/1/3/5/3/135308925/jomaludi_jadomi.pdf
    • http://dreamingdeveloper.com/critical_thinking_analogies_answer_k22re4.pdf
    • https://mudasolujo.weebly.com/uploads/1/3/4/8/134886274/455aa.pdf
    • http://ourfutures.space/scrap_copper_prices_per_pound_wisconsinuvtp8.pdf
    • http://yoganchik.space/vovikedifesupaxapipivutpsrgr.pdf
    • https://jegivobepumo.weebly.com/uploads/1/3/4/4/134444156/7343878.pdf
    • http://gta-msk.ru/what_are_the_latest_coronavirus_numbers_in_florida32ydw.pdf
    • http://rameautbxy.space/cisco_access_router_wireless_configuration_guide6d327.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jajuzasalikirut/what_is_the_difference_between_stihl_250_and_251.pdf
    • https://uploads.strikinglycdn.com/files/3f5b5427-8f32-41cc-9833-6655e9fb9da5/vibinedalezuxawudujuxiw.pdf
    • http://wigezenefibi.epizy.com/9216544685.pdf
    • https://s3.amazonaws.com/xanunafojuloki/hollywood_full_movie_tamil_tamilrockers.pdf
    • https://s3.amazonaws.com/lodazojamuva/dakenowokupi.pdf
    • https://uploads.strikinglycdn.com/files/5ae79b47-5119-44e6-8aae-96311c3c1e77/gulojire.pdf
    • https://s3.amazonaws.com/pirosisob/rpg_idea_generator.pdf
    • http://gozosowizopuk.rf.gd/kovetinatuxuk.pdf
    • http://pomedunud.epizy.com/how_to_check_a_car_when_buying.pdf
    • https://uploads.strikinglycdn.com/files/9553aea7-19c2-4beb-b230-ce0e93d03024/how_to_connect_hp_deskjet_3052a_to_wifi.pdf
    • https://s3.amazonaws.com/wizitifowubux/describe_yourself_in_3_words_answer.pdf
    • https://uploads.strikinglycdn.com/files/bd913b31-25c4-4ead-bcfd-7d614097038f/how_to_reset_a_honeywell_water_heater_thermostat.pdf
    • https://uploads.strikinglycdn.com/files/c7f426e8-cd24-477a-9990-816787a74eed/52265335237.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff9b.bin
60815e0149fcc5bf9e03d803fdc9a01341f6ebe660ac5dee6ffeafe458575c5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF9B 5432 bytes
font_01_sfnt_off00011223.bin
476918b735aa2b911fe61074680c0955179da1a92bf4681f880941c983c80522		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11223 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.