Malicious PDF — malware analysis report

Static analysis result for SHA-256 48329a712c0b8302…

MALICIOUS

PDF

69.3 KB Created: 2021-03-14 15:04:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e2987185215b2428ae0c75e93c8a4bce SHA-1: df6750387a68455833fcf78a9e9159726535c441 SHA-256: 48329a712c0b830269e6c4d8c31b49c3d1202bfd3316575778f1deb92e7c2a03
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains multiple embedded URLs, with the primary one being https://jumiwimov.ru/wix?keyword=mathematics+all+around+5th+edition+answers. The document's content, though heavily obfuscated, appears to be a lure, likely for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent, suggesting it's a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=mathematics+all+around+5th+edition+answers
    • http://lazotub.mywebcommunity.org/4566529469.pdf
    • https://gabejopow.weebly.com/uploads/1/3/4/5/134597712/53385f479.pdf
    • http://rinujajija.getenjoyment.net/metabolic_confusion_meal_plan.pdf
    • https://werotibumef.weebly.com/uploads/1/3/4/9/134900185/37408436.pdf
    • https://rajafobumexa.weebly.com/uploads/1/3/4/1/134109296/butabigovonizixi.pdf
    • http://pejelurim.getenjoyment.net/24812738636.pdf
    • http://felesatediz.medianewsonline.com/nedalifejabosupejis.pdf
    • https://natuxebifenukud.weebly.com/uploads/1/3/1/3/131378868/768db6d2b70.pdf
    • http://redpandarecycling.com/visualization_guided_meditation_scripts3vo2.pdf
    • http://zijaditenup.getenjoyment.net/86169345999.pdf
    • http://mekapidi.medianewsonline.com/blank_map_of_spanish_speaking_countries_and_capitals.pdf
    • http://bumumapa.mypressonline.com/where_can_i_see_christmas_lights_for_free.pdf
    • http://draiwenstore.online/lozorosonufadume3uqnt.pdf
    • https://mikakomigat.weebly.com/uploads/1/3/6/0/136054060/48d1ab3e8.pdf
    • http://befigter.xyz/agrippa_book0ijrt.pdf
    • http://zugasanuko.getenjoyment.net/zakigukuserurot.pdf
    • http://ujjjrrrrr.space/all_of_dance_dj_songngwwc.pdf
    • http://jusojixanona.getenjoyment.net/18852546921.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tokozod.myartsonline.com/74395562900.pdf
    • https://uploads.strikinglycdn.com/files/94b49051-f22f-4101-8041-9081cee5bf71/rheem_gas_hot_water_heater_installation.pdf
    • https://uploads.strikinglycdn.com/files/338edc0b-7f42-4519-9088-afb107ce6728/kung_fu_panda_legends_of_awesomeness_enter_the_dragon_game.pdf
    • http://jusopetikikij.onlinewebshop.net/65350016922.pdf
    • http://wenibeliso.atwebpages.com/lugibarifoduvopo.pdf
    • https://uploads.strikinglycdn.com/files/da188c1c-e902-4710-97ab-5e6b91349b0a/1668986200.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cfa8.bin
13d516b7d205d1df03d1e412c2e8d8a73edcd803d70e768fd3333d5c84d71e2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCFA8 5400 bytes
font_01_sfnt_off0000e1f5.bin
96e20a803afad6b2489c826cf84223883167d115127e3953a51fc2c036d5d254		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1F5 10576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.