Malicious PDF — malware analysis report

Static analysis result for SHA-256 f98a361ddbf8450b…

MALICIOUS

PDF

74.8 KB Created: 2021-02-28 14:44:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 490b344e47884c55595853cd33ef7a5d SHA-1: 71fe536b6b2b96a09f4ba09d0c3b86eb24bb2d7b SHA-256: f98a361ddbf8450ba4894649cde3ecb87c27a09b6c466ee6e3fe3556ab30f0db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. The document body, though heavily obfuscated, contains text related to obtaining a game for free, which is a common lure. An external URI pointing to 'seumenha.ru' was extracted, likely serving as the malicious payload delivery or phishing destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+get+rainbow+six+siege+for+free+rtx
    • http://zeboxagekej.sportsontheweb.net/kioti_lk3054_repair_manual.pdf
    • http://kpovli.ru/tank_trouble_unblocked_games_at_schooljovqs.pdf
    • http://kesuvajeb.scienceontheweb.net/basketball_plays_for_middle_school_against_zone.pdf
    • http://wifejopoxakobo.iblogger.org/luwelutagujubewuduzu.pdf
    • https://cdn-cms.f-static.net/uploads/4463552/normal_602e62db65349.pdf
    • https://static.s123-cdn-static.com/uploads/4453118/normal_5fc95fe73584b.pdf
    • http://gojawufeki.getenjoyment.net/97540590952.pdf
    • http://jibitivi.66ghz.com/chessbase_apk_full.pdf
    • https://cdn.sqhk.co/nufopusifa/Gjicsji/dasatibin.pdf
    • http://bepibolet.22web.org/toxufikamejafepa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://radagosedapisat.epizy.com/27859505429.pdf
    • http://duxurajixi.rf.gd/rogawotulanoraremilesek.pdf
    • http://belepegaxotimi.rf.gd/nogapubakuxoni.pdf
    • http://riwofepijisanet.epizy.com/43029588055.pdf
    • http://zesafemumibow.myartsonline.com/nessun_dorma_meaning_english.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9d6.bin
ef3cfd9f61e1da6331e33d6cd93ada2873178410d0d2c2e7d5c620f103dcadc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9D6 5164 bytes
font_01_sfnt_off0000fb8e.bin
e58ac83f7f51f1da60a3061f486f7137fc22acd19583126090c3d81200e921d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB8E 10076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.