Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bfc9ea7a9aab07d…

MALICIOUS

PDF

79.3 KB Created: 2021-03-24 23:33:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5cb9b2fb89fde394263e42e5dae9850c SHA-1: d321f3bdfc01ebef857943171697862e73a4cae5 SHA-256: 5bfc9ea7a9aab07d7a65e2da25326059b0876fd72b9889d67ef51213f3a49651
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating phishing and trojan characteristics. An external URI pointing to 'jumiwimov.ru' was extracted, suggesting a redirection or download attempt. The document body, though heavily obfuscated, contains text related to 'study guide zone algebra 1', aligning with the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=study+guide+zone+algebra+1
    • https://cdn-cms.f-static.net/uploads/4384628/normal_6023d9f572c39.pdf
    • http://beguwidip.scienceontheweb.net/behringer_um2_manual.pdf
    • http://luminar3-download.xyz/how_to_win_liars_dice_in_thieves_landingwhga4.pdf
    • http://jakesubinosol.scienceontheweb.net/buwibomomar.pdf
    • https://static.s123-cdn-static.com/uploads/4503050/normal_5ff8b58329abf.pdf
    • https://cdn-cms.f-static.net/uploads/4381289/normal_601fa957ebf2f.pdf
    • http://lipexifinidoda.scienceontheweb.net/98802786692.pdf
    • http://kafalukuwemi.mygamesonline.org/igcse_biology_revision_booklet.pdf
    • https://static.s123-cdn-static.com/uploads/4482415/normal_6006f95a359e4.pdf
    • http://carinsusa.com/335135556094t8uv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://tokafibalo.epizy.com/saviterudopapaka.pdf
    • https://933527c5-e005-4225-a3aa-05fee46c7696.filesusr.com/ugd/b51dd5_ff52ad01c2e9489e8f9f5541e2cb83e2.pdf?index=true
    • http://domulogud.epizy.com/84500559008.pdf
    • http://mugagogebopoga.rf.gd/canales_y_medios_de_comunicacion.pdf
    • https://uploads.strikinglycdn.com/files/ecfe0949-b923-4111-91f0-544bfeabd9b4/what_is_network_unlock_code_for_att.pdf
    • https://uploads.strikinglycdn.com/files/95503350-feab-4bb1-94f7-3ea5ec8c71a4/doterra_essential_oils_guide_book.pdf
    • https://uploads.strikinglycdn.com/files/12daf143-84c6-44d0-96c7-d3f8390cfb88/th350_transmission_identification_codes.pdf
    • https://cad90261-f038-4e8a-b384-2e0e37e6cb8c.filesusr.com/ugd/4c4e45_16a520923b804abdbca69ec3d63238d9.pdf?index=true
    • http://xiwexuxe.atwebpages.com/monsanto_acetic_acid.pdf
    • https://cd5075e9-4951-46bd-8d13-413fdd501c9b.filesusr.com/ugd/eceaf1_4ecb8c4a38f4434a9b2c7c1659de8f07.pdf?index=true
    • https://uploads.strikinglycdn.com/files/eed1cc35-c172-44fe-b594-a64e70a6c763/cs_lewis_miracles_chapter_summary.pdf
    • http://fiderifi.rf.gd/74981602918.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e89b.bin
2cb42cf2fba0f42996afa4b7a7d42351024b42c85bf971dc7c9729d849f6371a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE89B 5144 bytes
font_01_sfnt_off0000fa30.bin
bc5841b298a93708e9193ff0562a02aafa26da1e5c0527c6ce1cf62f2d0513c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA30 11068 bytes
font_02_sfnt_off00011fdf.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FDF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.