Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bd0a627df61ebf1…

MALICIOUS

PDF

72.7 KB Created: 2021-03-31 11:42:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3cce358cb4f095bcd6f0cfc90541979d SHA-1: 229d571b77ecf62abc5fb05a21c132a01ac1217b SHA-256: 8bd0a627df61ebf1f4d8625effcadb4e1f3d33608a6f33aeb2ae328895817a5e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to 'jumiwimov.ru', which is flagged as suspicious. The document body, though heavily obfuscated, suggests a lure related to online courses, a common tactic for phishing or malware delivery. No scripts were extracted, but the presence of an external URI and the overall malicious verdict strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=c+programming+online+course+in+hindi
    • http://bitcoinlearningcentre.online/movie_converter_to_mp4coisv.pdf
    • http://fsbsiod.com/suwewifurele1qxh1.pdf
    • http://dirtygirl.fun/ikatex_s.a_de_c.v89kbe.pdf
    • http://nikaold.site/game_of_thrones_cast_season_3_episode_4kkq2k.pdf
    • http://fsfsfd.xyz/revujitmq69.pdf
    • https://zakesulukagog.weebly.com/uploads/1/3/4/4/134493448/tegoforet_puvazorot.pdf
    • http://kulapub.22web.org/interview_questions_to_prepare_for.pdf
    • http://wide-do.top/nozinediko94a1.pdf
    • https://cdn-cms.f-static.net/uploads/4387706/normal_6063bb3826038.pdf
    • https://static.s123-cdn-static.com/uploads/4379970/normal_5fc97c45729ee.pdf
    • https://keregejuvuja.weebly.com/uploads/1/3/4/3/134345288/3cb425.pdf
    • https://tubidurifubadas.weebly.com/uploads/1/3/4/8/134885002/jetusesupovoreb-nedunufimox.pdf
    • https://cdn-cms.f-static.net/uploads/4388818/normal_5fe77eefc9f4e.pdf
    • https://degegoza.weebly.com/uploads/1/3/0/8/130873855/f49f7f1b0157f25.pdf
    • https://static.s123-cdn-static.com/uploads/4425506/normal_60037047132d6.pdf
    • http://optarfes.com/461675261048ovto.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lelogesisuzekat.rf.gd/coordinate_plane_word_problems_worksheet.pdf
    • http://jezepanan.rf.gd/jerogitarale.pdf
    • https://8dcf3d85-40eb-4350-b789-ae6ac2c46e24.filesusr.com/ugd/21d17a_925c0bbca1414e56a6643aa75e379cce.pdf?index=true
    • https://b860438a-ced3-4995-86f2-ad9a24e3f15c.filesusr.com/ugd/938eb2_67c92620158c43f1bc4997c5702a9245.pdf?index=true
    • http://varogofef.epizy.com/avengers_endgame_script_download.pdf
    • https://ef2e072a-e8a2-4438-804d-cc750be2e2f6.filesusr.com/ugd/6a22cb_4b856f1e93fc473bab487d44b8b26bee.pdf?index=true
    • https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_d42b7729dd294aba94e1d0fa5bbe45c1.pdf?index=true
    • https://95a57b4d-a24c-4412-bd87-88f4f885d252.filesusr.com/ugd/011e4b_46e2cc71a66943d984de2fd6b98d2a5c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de3e.bin
bc8e363ddcd5097a29e97c5a4a693d7a1d879e1765d7d701fea5fcb1e9fe384a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE3E 5392 bytes
font_01_sfnt_off0000f062.bin
3c0367190222415d58d15e8d9646143e973fac2f51740edb40433562599c162a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF062 10316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.