Malicious PDF — malware analysis report

Static analysis result for SHA-256 839af1ada3a305d6…

MALICIOUS

PDF

67.7 KB Created: 2021-03-24 19:55:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb23a5a493fcf64f51634d063c6d9ea6 SHA-1: d85243dbe586e3570c03e15df1a2ca4db1d50b3d SHA-256: 839af1ada3a305d69eeeb6e0156df4292742e13383a7cf1d0be9f47699270481
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with the primary one being https://jumiwimov.ru/award?keyword=incidencia+prevalencia+pdf, suggesting a phishing or malware distribution lure. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=incidencia+prevalencia+pdf
    • http://nanamojuvimujo.medianewsonline.com/39622790332.pdf
    • http://kompledom.com/10136487496cwp4p.pdf
    • http://koparikamoze.scienceontheweb.net/tijiferanu.pdf
    • http://idealslimitalia-official.site/combining_like_terms_practice_sheetza9rv.pdf
    • http://nebemor.mywebcommunity.org/ginokavig.pdf
    • http://wijetaz.mypressonline.com/hoi4_black_ice_division_guide.pdf
    • https://cdn-cms.f-static.net/uploads/4454682/normal_601db112decbe.pdf
    • http://3203epworthcres.com/i_robot_full_movie_in_hindi_google_drive1l83t.pdf
    • http://fekowepiz.mywebcommunity.org/50748508411.pdf
    • http://fumexijana.getenjoyment.net/ktm_500_exc_owners_manual.pdf
    • http://nosinoski.shop/martin_luther_commentary_on_romansc5cn6.pdf
    • http://rejorevubirobu.sportsontheweb.net/platicas_pre_bautismales_en_domingo_en_guadalajara.pdf
    • http://sportplays.ru/blomberg_dishwasher_repair_vancouver3p3vd.pdf
    • http://veselutut.mywebcommunity.org/numefozokevusefalezujadu.pdf
    • http://kmikaerfs.ru/2010_camaro_rs_packagexj6k9.pdf
    • http://pifafixejizigu.scienceontheweb.net/25548326423.pdf
    • http://fevevafo.medianewsonline.com/understanding_pathophysiology_6th.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ba383c79-c578-4ddb-a22b-a99ee5859b2e/linksys_ea6400_alternative_firmware.pdf
    • https://uploads.strikinglycdn.com/files/f18275c0-cf24-4b74-85f9-1f3af97ed078/chemistry_live_workbook_solutions_chapter_21.pdf
    • https://uploads.strikinglycdn.com/files/e92018a6-3b00-44e3-aca4-da230cc6703f/21346163817.pdf
    • https://uploads.strikinglycdn.com/files/697ce09f-a3ca-4bee-a042-e79ab430612d/govamife.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000caa5.bin
2ebde7a8b747ee97314e980f74773a347a8046eff3b2c453b65176db4f54c295		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCAA5 4968 bytes
font_01_sfnt_off0000dba8.bin
7eb6a53e45cbff3826ffb124cef932c6f2c6fa659cb6f4788d9fdbde018fcadb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBA8 11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.