Malicious PDF — malware analysis report

Static analysis result for SHA-256 258401480bdf1c2e…

MALICIOUS

PDF

76.6 KB Created: 2021-03-19 23:15:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c2a5b6a91f29abfb461aa5c0d2d18184 SHA-1: 71bf48aa03ff2445cbae758ff241793f8535a93c SHA-256: 258401480bdf1c2ea103c118bcbb8b6f8146e474653e179c79cf2f0ac4c614d0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning model indicated a high probability of maliciousness. It contains numerous external links, including one pointing to 'jumiwimov.ru/award', suggesting a phishing or malware distribution attempt. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' indicate the document's primary purpose is to redirect users to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=thrombocytopenia+in+dengue+pdf
    • http://stingeksoj.online/samurai_warriors_4_weapons_guide53pln.pdf
    • http://fesurowejo.mywebcommunity.org/ways_to_prevent_climate_change_at_school.pdf
    • http://rameautbxy.space/91071656193he9dj.pdf
    • http://sefobadivura.iblogger.org/ap_seminar_performance_task_2_rubric.pdf
    • http://xudogiborijum.66ghz.com/barozezimiwova.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zezevefo.rf.gd/windows_10_shortcuts_deutsch.pdf
    • http://magakawigola.epizy.com/aerobika_instructions.pdf
    • https://uploads.strikinglycdn.com/files/fa0eb87f-ba5b-4ad3-9cfa-5e1fa1360673/tokyo_ghoul_series_list_in_order.pdf
    • https://uploads.strikinglycdn.com/files/26a185a7-8abe-4b23-bf14-52a59d11987d/master_of_the_universe_toys_list.pdf
    • https://uploads.strikinglycdn.com/files/e30fbab3-84ea-4544-955f-070fff85f975/how_much_do_substitute_teachers_make_in_colorado.pdf
    • https://uploads.strikinglycdn.com/files/f25f2fa6-c19d-41e6-b5b5-3285457f03ea/gufilidoxewepoduwu.pdf
    • http://zonatitusajobo.onlinewebshop.net/suratalimosodafa.pdf
    • https://uploads.strikinglycdn.com/files/7977760e-d4f0-45df-941c-fcc188357092/puxenigiribilusupojomiri.pdf
    • https://uploads.strikinglycdn.com/files/a5cb5671-2358-4e0f-b416-8eac8454c977/82977498759.pdf
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_013dddad99734f4ebd99acb0add406e7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/483302b6-1849-432f-b409-709fc781428c/cirrus_sr22_service_manual.pdf
    • https://5e6d3f51-9b35-4a29-baf4-1f036254a461.filesusr.com/ugd/99a8f2_f28c9b1ab0c2437291ec13b54fde99a4.pdf?index=true
    • https://2ddedb0e-b7b0-41c9-a8bc-c018bd0e6e4c.filesusr.com/ugd/70094d_738456edc4bf426ca1c68349713f6ef7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfd6.bin
19cdcb079f4c38e6b0ee0cda00856b0772c678d4cbab0038f3131a578c25a121		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFD6 5432 bytes
font_01_sfnt_off0000f229.bin
d486586da9bb2c7ca794a0472dd9f4b5b25d872c7b5b6c456fda2cc705837d96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF229 10856 bytes
font_02_sfnt_off0001175b.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1175B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.