Malicious PDF — malware analysis report

Static analysis result for SHA-256 e52f301df21f3353…

MALICIOUS

PDF

74.9 KB Created: 2021-04-05 13:40:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 390624efaac81cb2f86ab2cbfe453ec5 SHA-1: a95ac7bb1331c9b21a80923461e792a5b800c855 SHA-256: e52f301df21f3353705fa6ede4c3cd04fc0250db23fad1ec362ea1ac5c555127
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'seumenha.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to 'warehouse safety rules'. No scripts were extracted, but the presence of external URLs and the overall detection profile strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=warehouse+safety+rules+for+visitors
    • http://dosaxixapaxa.medianewsonline.com/gupojuv.pdf
    • http://kunepuvobimamin.medianewsonline.com/how_to_import_java_swing_project_in_eclipse.pdf
    • https://cdn.sqhk.co/xogutozo/ABNjhgc/29172880618.pdf
    • http://bosuxezaxad.mypressonline.com/california_high_school_chemistry_textbook.pdf
    • https://cdn.sqhk.co/tororukiwuri/Jighgjb/photo_lab_picture_editor_face_effects_app_download.pdf
    • https://cdn.sqhk.co/bulunazi/C0xZnjd/61378647621.pdf
    • https://cdn.sqhk.co/zesojesiwi/dLgeHha/lovelace_hospital_downtown.pdf
    • https://cdn.sqhk.co/befozaxulot/chi1bBt/fighting_tiger_liberal_mod_apk_2._7._1.pdf
    • http://xoxanuf.mygamesonline.org/laxasozasefu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/930f7656-7a27-456f-8ac1-de33eeee4b98/how_to_install_hx_stomp_firmware.pdf
    • https://s3.amazonaws.com/mavixu/dunezesiwixatopusebiduw.pdf
    • https://uploads.strikinglycdn.com/files/64f8f190-bf95-43a2-bf79-602764a1bd5f/kajifew.pdf
    • http://suvalomimo.atwebpages.com/red_pyramid_audiobook_free.pdf
    • https://s3.amazonaws.com/fusopoxipo/what_does_the__emoji_mean.pdf
    • https://s3.amazonaws.com/xoxaneral/can_i_video_from_linkedin.pdf
    • https://s3.amazonaws.com/vunizi/lista_de_verbos_irregulares_en_ingles_y_espaol.pdf
    • https://uploads.strikinglycdn.com/files/8b485c6e-bdcc-446b-a11d-de293c2c2656/how_to_change_wallpaper_on_amazon_fire_tablet.pdf
    • http://zagofij.onlinewebshop.net/alaska_bear_tales.pdf
    • https://uploads.strikinglycdn.com/files/5d5769e0-f139-4452-afe7-e582285aee62/exame_de_fezes_como_fazer.pdf
    • http://tijuvewoduga.onlinewebshop.net/how_to_reset_honda_maintenance_minder_light.pdf
    • https://s3.amazonaws.com/kifutizijebuj/structure_text_language_in_plc.pdf
    • https://s3.amazonaws.com/bivanud/how_to_analyse_text_structure.pdf
    • http://pavabiza.atwebpages.com/19409930822.pdf
    • http://pitaken.onlinewebshop.net/81624246700.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb63.bin
7fcfd8efc0da553e4eda2ed849ee4f7e48fb9b8f7d24d505f4551805a1b23a8a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB63 5032 bytes
font_01_sfnt_off0000fc90.bin
e85b12d5ed33d3c835ee32ee84025743af8cea6a9b10bd7643a605e935353c34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC90 9760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.