Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c0fff8fb59a4e7e…

MALICIOUS

PDF

86.1 KB Created: 2021-03-17 22:14:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8a128c35d5968f90545f179d5bae38ae SHA-1: bd93561028c2b8ea5c9af2543e7246ce7b5b1473 SHA-256: 4c0fff8fb59a4e7e5746ab244aba3097260362b1be4879461c062dffa9911370
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://jumiwimov.ru/strik?utm_term=how+to+make+christmas+nativity+scene` suggests a phishing or social engineering lure, attempting to trick users into visiting a compromised site. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards malicious content designed to exploit users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=how+to+make+christmas+nativity+scene
    • https://cdn.sqhk.co/lewoxiguj/chcYgcl/28445777099.pdf
    • http://supportcopyright.net/endorsement_letter_template_usmccqmi1.pdf
    • https://cdn.sqhk.co/dufubimaru/jXL1i1G/cassandra_clare_red_scrolls_of_magic.pdf
    • https://cdn.sqhk.co/bilejufikone/j6gejba/89317315929.pdf
    • https://cdn.sqhk.co/bozadukopufu/VXU4Eih/racing_bike_tires_reviews.pdf
    • https://cdn.sqhk.co/loxexafetivu/gj5ijhd/94077035306.pdf
    • https://cdn.sqhk.co/jonolamojof/heuhihY/photograph_arcade_fire_piano_sheet_music.pdf
    • http://nigasheff.xyz/32631694686x2pc3.pdf
    • https://cdn.sqhk.co/visesefider/hha2whb/detective_story_ideas.pdf
    • http://b4shop.icu/zinuvizekodekofartxs37.pdf
    • http://canonsburglake.com/pebopatefawojom3b57.pdf
    • http://topcreditcheck.info/66696000724ttdum.pdf
    • https://cdn.sqhk.co/rapawaferew/7hjaiaD/twitter_video_downloader_apple_shortcut.pdf
    • https://cdn.sqhk.co/bepoweruga/BG4dWhc/tubapedifekizozapiza.pdf
    • https://cdn.sqhk.co/fiseguvugele/jicS9i9/idle_town_roblox_id.pdf
    • https://cdn.sqhk.co/nexetifosam/Ehijgji/snoke_darkness_rises_and_light_to_meet_it.pdf
    • http://store50off.info/york_gas_furnace_parts_diagramgi7ao.pdf
    • http://itgermany.net/xaxojubojizetezebarof609p.pdf
    • https://cdn.sqhk.co/fuxiwimemo/9Hk0Lv9/lijamobomu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/613fb734-fad5-4a1c-a8f1-85f02e6b463c/stihl_leaf_blower_for_sale_near_me.pdf
    • https://uploads.strikinglycdn.com/files/425e5f7b-2583-4bf2-ab35-60d199eda201/97344809812.pdf
    • https://uploads.strikinglycdn.com/files/e30241fe-1144-4125-8807-59a6f49c60c8/59076669089.pdf
    • https://uploads.strikinglycdn.com/files/72c82f37-4757-4771-9821-f41322a329e8/33417187450.pdf
    • https://uploads.strikinglycdn.com/files/5627053b-9af6-4e51-a428-411c681107a2/what_is_a_seasonal_worker.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010519.bin
a48e7d91760a31811265947fb6cf5e7bd419ed98b0a7946d5be7fc85716c3146		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10519 5076 bytes
font_01_sfnt_off00011640.bin
beaa4424c28e67341ceb7f636f8bc0c1c703eeddcb7ac0dc7439eba91f241702		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11640 11300 bytes
font_02_sfnt_off00013cc2.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CC2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.