Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e6019a8c14c251a…

MALICIOUS

PDF

81.4 KB Created: 2021-04-19 21:39:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad174e275c95a01dcce78eba905b614a SHA-1: d6ec65f1e5f047514e26f3bba8d1936e8fc83826 SHA-256: 4e6019a8c14c251a74d1a430236cea6047c267e922bff5619e0078e19dc45ec6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The embedded URL, https://jumiwimov.ru/strik?utm_term=unshakeable+tony+robbins+app, is the primary indicator of malicious intent, likely leading to a phishing or malware download site. Although no scripts were explicitly extracted, the PDF structure and the presence of an external URI suggest an attempt to redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=unshakeable+tony+robbins+app
    • http://dubulus.iblogger.org/weather_report_manzanita_oregon.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ca6fb3ec-42dc-4a50-9206-6680186620f0/94240532286.pdf
    • https://s3.amazonaws.com/bexolamabad/bewapuvosir.pdf
    • https://uploads.strikinglycdn.com/files/1b0921ba-3934-4a2f-a0b4-7c3c585caead/resmed_s9_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/3b52f1f7-ce46-42f0-a824-914eed6002db/pojukabigored.pdf
    • https://s3.amazonaws.com/wegemebufojafak/2005_honda_civic_ex_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/3f418165-aa56-427d-86db-0c8a7c9f76da/49547653887.pdf
    • https://uploads.strikinglycdn.com/files/090d5f55-1998-48ef-ac51-aa389ef5423f/45221921648.pdf
    • https://uploads.strikinglycdn.com/files/57e4f560-29c9-4882-bed6-cb63b48a679f/dedukojozi.pdf
    • https://uploads.strikinglycdn.com/files/4bc69338-0eca-46ee-92af-3678c55508b1/pibagitatote.pdf
    • https://uploads.strikinglycdn.com/files/e85f105f-b469-4942-b182-3b956a28c7cb/54235719016.pdf
    • https://uploads.strikinglycdn.com/files/6b86d605-3c97-4d7a-b8d6-06ce4affbf3f/what_is_the_definition_of_absorption_of_light.pdf
    • https://uploads.strikinglycdn.com/files/a0eb48f4-e5b9-4d43-8f47-7a659d46f4dd/principles_of_economics_mankiw_chapter_27_ppt.pdf
    • https://uploads.strikinglycdn.com/files/9a66ac09-1586-4836-a44e-2894a8554d02/nanusifamikis.pdf
    • https://uploads.strikinglycdn.com/files/8bbfd856-de1b-435b-9c59-91795ca9549f/black_and_decker_toaster_oven_size.pdf
    • http://zaxatuparogojix.epizy.com/zovorojobibabomataji.pdf
    • https://uploads.strikinglycdn.com/files/861daf1e-d664-450c-8a4f-0fed116c3a40/1_ml_cuantos_gramos_son.pdf
    • https://uploads.strikinglycdn.com/files/a82e76a6-bd74-4f43-ba32-f3fbdfcb1a4b/noco_genius_g750_not_working.pdf
    • http://jekutekovemimav.rf.gd/u2_until_the_end_of_the_world_lyrics_chords.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f320.bin
42a848f618ae70461b4791315a91804c008820a0b936082a9dd27db087612963		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF320 4992 bytes
font_01_sfnt_off00010404.bin
dd2d10c852f35188c60485f8c940de2f95a4e9b78cf6c6dd06bf151d0818f787		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10404 11276 bytes
font_02_sfnt_off00012a90.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A90 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.