Malicious PDF — malware analysis report

Static analysis result for SHA-256 5495c390dd8a261f…

MALICIOUS

PDF

330.0 KB Created: 2021-03-16 21:17:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9602f3fd4a9a7da5899bdede09aae7e1 SHA-1: 73cfdea839cc14c2daf380c3ea54e0d7073b93b5 SHA-256: 5495c390dd8a261f84b5ee0cb6bab5ba9e6efcebd4635ece7ae884b862fc7056
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was identified as malicious by ML classifiers and ClamAV, with high confidence. It employs an advance-fee scam lure, indicating a phishing or fraud attempt. The presence of external URIs, specifically the one pointing to 'jumiwimov.ru', suggests the document is designed to redirect the user to a malicious site, likely to download further malware. No scripts were extracted, but the PDF structure and external links are indicative of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9818

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=major+historical+events+in+the+2000s
    • http://lienforkid.com/faktriyel_sorular_aleslhk4j.pdf
    • https://marizezibafive.weebly.com/uploads/1/3/4/8/134865590/sudag_zolipe_fesiv.pdf
    • https://cdn.sqhk.co/luwesefizi/b1vKWh9/tumblr_quotes_funny_relatable.pdf
    • https://cdn.sqhk.co/bozutebux/jCuBVie/ship_mooring_3d_pc.pdf
    • https://cdn.sqhk.co/bijilixiger/gfgff2n/gekativekufove.pdf
    • https://cdn.sqhk.co/wikaraxixi/iNjjKhe/mekanisme_kerja_obat_antasida.pdf
    • http://gavediteriremuv.medianewsonline.com/xudigupeledudezekonuzozor.pdf
    • http://golixudib.mypressonline.com/what_makes_a_metaphor_effective.pdf
    • https://cdn.sqhk.co/xaripisi/eC7hiwP/digestive_system_diagram_drawing.pdf
    • https://cdn.sqhk.co/fosigigamef/hidzmha/capsicum_extract_patch.pdf
    • http://kirakexig.mypressonline.com/70275740140.pdf
    • https://cdn.sqhk.co/zekafomaze/PLQgjhb/82947763288.pdf
    • https://cdn.sqhk.co/wevujawej/1ZJZgh5/gusilibexilokurudelofozo.pdf
    • https://fofifakexetag.weebly.com/uploads/1/3/4/3/134345684/c435dff45de.pdf
    • https://cdn.sqhk.co/vedasukuki/icsO1jc/38079734333.pdf
    • http://rankingcoach-apps.com/biwamudl2iiz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lokijuronig/extent_report_maven_plugin.pdf
    • https://s3.amazonaws.com/zakunafu/73333205073.pdf
    • https://s3.amazonaws.com/zulezov/apple_image_size_guidelines.pdf
    • http://ginowane.onlinewebshop.net/the_lightning_thief_musical_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004d3b4.bin
756928e0d92f3e3f78cb62f396b36a556c95644eec7b48d837e16126477dbfd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D3B4 5304 bytes
font_01_sfnt_off0004e5d0.bin
d33c3409f9e4e8886ef3338cdd4775ea3b819b8ed14b4fd35ce5f3204e5df582		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E5D0 16236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.