Malicious PDF — malware analysis report

Static analysis result for SHA-256 2fb0b27d2a05b175…

MALICIOUS

PDF

82.7 KB Created: 2021-06-05 16:40:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 975955edaeedbd578f48d39e3e9d9ccb SHA-1: c6de64b35629fc02d1cf91973505bbbadaaa4dcf SHA-256: 2fb0b27d2a05b1757f86154d512c4d7bec8c8793895cb223efbb3c3c84253464
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An external URI pointing to 'jumiwimov.ru' was extracted, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'video editing free online no', aligning with a lure for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=video+editing+free+online+no
    • https://cdn-cms.f-static.net/uploads/4503033/normal_6027304b4207e.pdf
    • https://static.s123-cdn-static.com/uploads/4474471/normal_5fde50e33fb64.pdf
    • https://gawidosenadipag.weebly.com/uploads/1/3/1/0/131069875/905758fbec945f.pdf
    • https://cdn-cms.f-static.net/uploads/4376096/normal_60b82eac8b89b.pdf
    • https://xenezukuxitolap.weebly.com/uploads/1/3/4/5/134528427/diviperu.pdf
    • https://cdn-cms.f-static.net/uploads/4407562/normal_602eea0cba2ab.pdf
    • https://xazopitanajemav.weebly.com/uploads/1/3/4/7/134714933/tavofawuz_pegona_jamopu.pdf
    • https://cdn-cms.f-static.net/uploads/4454299/normal_602a57d6a9c28.pdf
    • https://static.s123-cdn-static.com/uploads/4480728/normal_6003a1fe164b9.pdf
    • https://cdn-cms.f-static.net/uploads/4456135/normal_603358177fe03.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lifelekufa.pbworks.com/f/diwejujovug.pdf
    • http://vakerul.pbworks.com/f/kobipu.pdf
    • http://fuzujufod.pbworks.com/f/5662954621.pdf
    • http://mibegenav.pbworks.com/w/file/fetch/144650052/xodelifexeluxo.pdf
    • http://pebolokunaz.pbworks.com/f/breville_bread_maker_bb_400_manual.pdf
    • http://xifilipisi.pbworks.com/w/file/fetch/144423126/diep.io_mod_apk_unlimited_points_1.2.10.pdf
    • http://vuxoris.pbworks.com/w/file/fetch/144606948/letarexasitabotejexe.pdf
    • http://ziriwuru.pbworks.com/w/file/fetch/144599982/how_do_i_unblock_a_number_on_my_panasonic_cordless_phone.pdf
    • http://rutarotovez.pbworks.com/w/file/fetch/144646146/96209928648.pdf
    • http://zekodunu.pbworks.com/f/jesekapemul.pdf
    • http://puzavofan.pbworks.com/f/caja_de_fusibles_jeep_liberty_2010.pdf
    • http://gatasulupu.pbworks.com/w/file/fetch/144421854/xaxabeluwa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2b5.bin
bf552fd248f93141363a4094a333a0aa0004941370c133b06a0ca26aa512cdc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2B5 4124 bytes
font_01_sfnt_off00010183.bin
711c10cb24f27961de08a8d73db1699fbcf10f211276c38aec7ab63f169a9324		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10183 4652 bytes
font_02_sfnt_off0001116e.bin
57ad697d9dc7b9c0afbb81c419b27b9fcf310e83bb1c55fb532af67b4056442d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1116E 13684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.