Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9f1ccda917764be…

MALICIOUS

PDF

81.7 KB Created: 2021-04-11 16:25:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af4731cc77b1fd17d1d97a2a7c5d4303 SHA-1: 6b717d77b1b619e0ed3f0f0d24c81aff15067df2 SHA-256: f9f1ccda917764bed923846f5b627241037a1bb78cb4d6de3234c920483be69e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The embedded URL, https://seumenha.ru/strik?utm_term=d%2527link+ac3200+range+extender, suggests a lure to a malicious site. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a phishing attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=d%2527link+ac3200+range+extender
    • https://cdn-cms.f-static.net/uploads/4425230/normal_60140aec28f3d.pdf
    • http://ruvogodozipabiv.scienceontheweb.net/bangla_book_class_5.pdf
    • https://tunawirivam.weebly.com/uploads/1/3/1/4/131437064/2806635.pdf
    • https://cdn-cms.f-static.net/uploads/4475741/normal_5fd8ba3a41a6b.pdf
    • http://gejudoxe.mypressonline.com/asthma_action_plan_for_school.pdf
    • https://cdn-cms.f-static.net/uploads/4444882/normal_601471eab4701.pdf
    • http://juwupexutaval.mywebcommunity.org/libotumapevaxu.pdf
    • http://melidagerukebel.sportsontheweb.net/fundamentals_of_cost_accounting_3rd_edition.pdf
    • https://pevopuxavinedun.weebly.com/uploads/1/3/1/4/131406680/gesoxuxilixitu.pdf
    • https://mitemulesebiped.weebly.com/uploads/1/3/4/4/134479511/6f9a697eb0edd2.pdf
    • https://static.s123-cdn-static.com/uploads/4419191/normal_5fc5cc8ba5265.pdf
    • https://pujosudenavi.weebly.com/uploads/1/3/4/5/134508056/nikom_zekuzasijogok_fetonumetiva.pdf
    • https://nebutoribuve.weebly.com/uploads/1/3/4/6/134615115/624677.pdf
    • http://mufutekuson.getenjoyment.net/muwasubaw.pdf
    • https://cdn-cms.f-static.net/uploads/4450746/normal_6062c0747fcd0.pdf
    • https://static.s123-cdn-static.com/uploads/4484364/normal_5fcba19b04157.pdf
    • https://mipedurekarano.weebly.com/uploads/1/3/5/3/135321071/a56797.pdf
    • https://monivewuvafa.weebly.com/uploads/1/3/4/0/134096064/diwetunebojaj_mufizawe_vojamizutogo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lorugipopuxe/c._difficile_treatment_guidelines.pdf
    • https://s3.amazonaws.com/kovezux/how_many_questions_are_on_the_license_test_in_nc.pdf
    • https://s3.amazonaws.com/gisujubolidine/91347291930.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff91.bin
60d18a46d3515ac48f42302c2b95911dc064dc1ff4ba1c5f2f45515bdb12ba65
pdf-font-stream PDF embedded font (sfnt) at offset 0xFF91 5532 bytes
font_01_sfnt_off0001128c.bin
412f9bd108f9da845b5ba2f0c3d78f003cb93cbe1ba66d44ee176f67a25d80c6
pdf-font-stream PDF embedded font (sfnt) at offset 0x1128C 11336 bytes