Malicious PDF — malware analysis report

Static analysis result for SHA-256 82cd8dddb866dbeb…

MALICIOUS

PDF

74.6 KB Created: 2021-03-27 14:52:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b84376f8785c0e68d33d41986770ad33 SHA-1: 63021fab3916eeec4a9025ac8653c046bcb47182 SHA-256: 82cd8dddb866dbebc70c339d9e2cebe02231a39e205dd21f2b9ff7102e2bcbd7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'jumiwimov.ru' suggests the document is designed to redirect users to a potentially harmful site. While no scripts were explicitly extracted, the PDF_URI heuristic indicates the potential for embedded malicious links, likely used to download further payloads or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=basic+english+grammar+book+2+pdf+ann+seton
    • http://nofubajabuv.medianewsonline.com/adobe_illustrator_cs6_for_beginners.pdf
    • https://static.s123-cdn-static.com/uploads/4418574/normal_5fc69b24d08bf.pdf
    • http://lololoj.sportsontheweb.net/how_to_practice_law_in_canada_with_indian_law_degree.pdf
    • http://motubudasuvapan.medianewsonline.com/63644144915.pdf
    • http://kogowetek.getenjoyment.net/36856546789.pdf
    • https://cdn.sqhk.co/buwozumu/6ghjwgh/fcu_mobile_deposit.pdf
    • https://static.s123-cdn-static.com/uploads/4476930/normal_5fdfd0eed7589.pdf
    • https://static.s123-cdn-static.com/uploads/4460975/normal_5fc7fc298f2d5.pdf
    • https://cdn.sqhk.co/pabilere/Nhchaih/44054004037.pdf
    • http://mexawolin.medianewsonline.com/23998360550.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6929d4d2-a2b5-4e33-99d0-c535fefda640/diet_fit_for_life.pdf
    • https://s3.amazonaws.com/lazolu/1092681233.pdf
    • https://s3.amazonaws.com/xakajoziwibi/juwowitutoforuta.pdf
    • https://uploads.strikinglycdn.com/files/67884304-d7a0-4403-ac11-a6e4cd3bac2f/11452107628.pdf
    • https://s3.amazonaws.com/feseni/bam_bam_bole_video_song.pdf
    • https://uploads.strikinglycdn.com/files/694fedf9-e349-4f98-a276-ac596659390d/8162950187.pdf
    • https://s3.amazonaws.com/sepovutapakogaf/vutigesilemevuwupuf.pdf
    • https://uploads.strikinglycdn.com/files/010bbbb3-7c74-478d-a75a-8134e8020083/two_way_radio_wireless_earpiece.pdf
    • https://s3.amazonaws.com/simujix/71541731939.pdf
    • https://uploads.strikinglycdn.com/files/0739ab2a-9737-4b75-9bbe-5dcff2999ecb/re_zero_light_novel_volume_15.pdf
    • https://s3.amazonaws.com/wukara/animated_moving_wallpapers_for_mobile_free.pdf
    • https://s3.amazonaws.com/zobuwubedak/last_day_of_school_hillsborough_county_2019.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e48a.bin
2419c975c39b6eed1b741b86d31cef4460da354a790b906b9edf5effebbb99d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE48A 5956 bytes
font_01_sfnt_off0000f8a0.bin
295f2cf07cf340de7d0bd4af9278c2b16da77e7501c45fe1d0fbc446a97d4291		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8A0 10520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.