Malicious PDF — malware analysis report

Static analysis result for SHA-256 900e62aa7c402d7c…

MALICIOUS

PDF

93.1 KB Created: 2021-03-29 16:08:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7e93a7380dc27d2e14f2e6bab911312a SHA-1: b3b051b3110b1e4efdd801b84985073c7eaf399f SHA-256: 900e62aa7c402d7c8b2ed0fba97bcb809f396c275e69d8c27bd298b729f8f0c0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://jumiwimov.ru/wix?keyword=mediacom+tv+guide+valdosta+ga` suggests a phishing lure related to a TV guide. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a phishing or malware distribution campaign, likely leveraging social engineering to trick users into visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=mediacom+tv+guide+valdosta+ga
    • http://funasowuto.getenjoyment.net/37426814254.pdf
    • https://cdn.sqhk.co/kezulegol/vlngiid/big_bang_theory_staffel_13_netflix.pdf
    • http://kazaxidu.22web.org/falekugizelanoredi.pdf
    • https://cdn.sqhk.co/zutoruxutu/jfmjhrG/33442259513.pdf
    • https://cdn.sqhk.co/salenasova/ikhcNhi/water_pipe_bong_amazon.pdf
    • http://werikipirojenob.scienceontheweb.net/12783928432.pdf
    • https://cdn.sqhk.co/pepegizeso/5jdjjGt/29439426110.pdf
    • http://sijemogezabusa.sportsontheweb.net/lazarillo_de_tormes_completo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fadadedezeker/guardian_university_guide_2019_history_of_art.pdf
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_245f69c7a1bf40829a32de3f518cdba4.pdf?index=true
    • https://s3.amazonaws.com/zuses/dajuzazijoparemagelixi.pdf
    • https://uploads.strikinglycdn.com/files/95a8a3be-be72-47f0-a688-ade795f03640/75760882462.pdf
    • https://uploads.strikinglycdn.com/files/b6b8685e-62ff-4860-9f4a-501ea7cefb02/how_to_pass_algebra_1_test.pdf
    • https://s3.amazonaws.com/divexikav/kalumuwokuravelom.pdf
    • https://s3.amazonaws.com/pewibim/gasuresexafex.pdf
    • https://s3.amazonaws.com/tomaxade/indio_weather_report_california.pdf
    • https://uploads.strikinglycdn.com/files/35c3c593-89b0-46dc-9338-1e8b79c72b57/dna_structure_function_and_replication_worksheet_answer_key.pdf
    • http://laxukumelukadut.myartsonline.com/asus_ac68u_firmware_upgrade.pdf
    • https://af30af13-e0b7-4de0-aca7-7783c01eade2.filesusr.com/ugd/9757e7_6dabea179f6c4f61a5613010260c28dc.pdf?index=true
    • http://zenowalu.rf.gd/net_core_mvc_tutorial_linux.pdf
    • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_46799e2982b245419f282bb3ba44c33f.pdf?index=true
    • http://rurasikawasup.epizy.com/interview_questions_for_leadership.pdf
    • https://9fb0fece-6c2a-4f8b-8ff1-5d9ea67f5ee7.filesusr.com/ugd/f6a907_0cbbd202c11b4d85b7e40c9df9370a04.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001300f.bin
3a9ce8b81d1fc1943d959cd03cae939ff583686815fa7bb4123d3e10e6242821		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1300F 5228 bytes
font_01_sfnt_off000141e3.bin
c338212435d6776ada6887c810268254fb5b99b9d9ec59970798afc3e3f2f57b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141E3 11132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.