Malicious PDF — malware analysis report

Static analysis result for SHA-256 5084235865db6d37…

MALICIOUS

PDF

174.0 KB Created: 2021-03-20 19:11:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a2f20212d00b3f1f7c050ea3133bdf5 SHA-1: 9d97551d6268b14d1c440dd15f7e644cefd84366 SHA-256: 5084235865db6d37ec10cb6fc2eebf793f4f286abf158d645ac76a0d8341b843
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain 'jumiwimov.ru'. The document body, though heavily obfuscated, suggests a lure related to a 'physics a first course answer key'. ClamAV detection and ML classification strongly indicate maliciousness, likely a phishing attempt to redirect users to the identified URL. No scripts were extracted, but the presence of an external URI and the phishing lure are strong indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=physics+a+first+course+answer+key
    • https://cdn-cms.f-static.net/uploads/4386086/normal_6056163060c62.pdf
    • https://cdn.sqhk.co/nuzitomizaj/fvNjhib/lamofagevitewunefejerejug.pdf
    • https://cdn.sqhk.co/dodufiruw/8ksHIhb/minimalist_winter_wardrobe_checklist.pdf
    • https://static.s123-cdn-static.com/uploads/4369507/normal_5ff5ea2574b77.pdf
    • https://cdn-cms.f-static.net/uploads/4475866/normal_604cf445e9f02.pdf
    • https://cdn.sqhk.co/riketumes/fiflict/xosevoxizonasoluturu.pdf
    • https://cdn.sqhk.co/lepavenujal/d7ggidn/41483624685.pdf
    • https://cdn.sqhk.co/vegedusovo/biihgji/ordinary_definition_oxford.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d9226533-59f4-4737-ae77-cfa9cdee5378.filesusr.com/ugd/d7c203_6cbf39b577e24c169cf7bdfec1519e9f.pdf?index=true
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_10d05d493b834135bd2b1c7052f5becc.pdf?index=true
    • https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_c76b9869716241f1804af7547005daf4.pdf?index=true
    • https://5a2ada08-5b6c-402a-b0df-3636415b461e.filesusr.com/ugd/434ae6_0325a98780b2419196ec5f2141ba9063.pdf?index=true
    • https://a0e9597c-cfbb-4fc1-b0e0-47ed6411b148.filesusr.com/ugd/24269e_737411c98b36497580a1e36ab5e0b066.pdf?index=true
    • https://s3.amazonaws.com/xurixado/29196539272.pdf
    • https://74fc1a11-d445-4ffb-bc6b-7a79e5a65a18.filesusr.com/ugd/097bd5_ed7a50c042d64fb497a3a35e35a06b3d.pdf?index=true
    • https://98771922-91e4-4673-aa0d-7794f4435593.filesusr.com/ugd/b6aaa0_7b876409f2ba4681aaa2530b94398db1.pdf?index=true
    • https://bef89f6e-6323-4b84-ad9d-a44490bfcc4f.filesusr.com/ugd/96768c_45809ac40826426082dc3794af72b775.pdf?index=true
    • https://923a8ca3-316b-4844-b38f-9bc955ad4852.filesusr.com/ugd/312e0e_de2e103476324657b267677eab0d6f97.pdf?index=true
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_e0ca4445dabf479c9b530925ea0de595.pdf?index=true
    • https://s3.amazonaws.com/memobofilenabon/tc_electronic_hall_of_fame_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000256df.bin
3723a82eac64fac67c954b8611fe0624c737930842177f6101fcce5696ce1738		 pdf-font-stream PDF embedded font (sfnt) at offset 0x256DF 5196 bytes
font_01_sfnt_off000268a4.bin
ee1a0466971949d47043c9753d33e1e1e02f68c1cb3c11a18a7170bf793f75c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x268A4 12420 bytes
font_02_sfnt_off00029340.bin
4861fab4caaee4cbe3681b05479d8bb0ff2f67f3948bc24c75c52ed6145b2217		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29340 16376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.