Malicious PDF — malware analysis report

Static analysis result for SHA-256 92c32f356b87eda8…

MALICIOUS

PDF

73.3 KB Created: 2021-03-16 23:34:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ff171072882929e9daf631ad7f917b10 SHA-1: 7b1d91d943730b2e64cb01b305d1a6e01cd0d586 SHA-256: 92c32f356b87eda8bf93a52707719ed16a3f74e456039b9122bc1a31bbe46f22
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers indicated a high probability of maliciousness. It contains a large number of external links, including one pointing to 'jumiwimov.ru', suggesting a phishing or link-farming attempt. The 'SE_CALLBACK_LURE' heuristic indicates the document may also be designed to trick users into calling a fraudulent support number.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=breville+manual+microwave+black+800w
    • http://tomogorman.com/how_to_study_science_subjects8olkk.pdf
    • http://antinomi.design/durogomavakanozusuz48d6f.pdf
    • http://jiwabozaxexe.mypressonline.com/86500850667.pdf
    • http://fb-copyright-help-from.com/manual_de_citizen_eco_drive_calibre_8700_stopped_workingcjby3.pdf
    • http://prizinsta.site/dajusalelatjdc4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bavufupuvamopaf.atwebpages.com/human_and_material_resources.pdf
    • https://s3.amazonaws.com/posufij/sample_microsoft_access_database_templates.pdf
    • https://80172413-d145-4b71-b7cf-4a007d76ad29.filesusr.com/ugd/cacfd7_955fa0e53f344785925451741d5b4f06.pdf?index=true
    • https://s3.amazonaws.com/dekogamik/2008_chrysler_sebring_fuse_manual.pdf
    • https://s3.amazonaws.com/zuses/gukevivajeregebi.pdf
    • https://s3.amazonaws.com/rizijubovapuk/windows_10_flash_drive_boot.pdf
    • https://uploads.strikinglycdn.com/files/3aae0106-ba75-4ca5-b88d-592bc73deaa3/32034307114.pdf
    • https://d7e981a8-8c4a-445e-aef0-60d3d4911bd2.filesusr.com/ugd/65d69c_c3b020d4f4b948d9958bf4195f5f6a42.pdf?index=true
    • https://s3.amazonaws.com/tesapibebujep/panasonic_bread_maker_sd_2511_manual.pdf
    • https://uploads.strikinglycdn.com/files/0e5205bf-cd0f-42d6-9d42-c5487be93f6f/86030615870.pdf
    • https://3d3b31fc-6152-41c7-b1d4-a4af3afcce63.filesusr.com/ugd/3f8d85_6d06d430cde947059ee83a1c7caf8601.pdf?index=true
    • https://e6343aec-df69-40e7-9959-3c0c55bf73c9.filesusr.com/ugd/6a9017_345b3e668cf340dabc4b4ed23c0063ba.pdf?index=true
    • https://98350ace-7ac4-4f38-a9d9-579fdad8050b.filesusr.com/ugd/9b2d9b_d87c30130b39419db995f7c0d0dbb626.pdf?index=true
    • https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_c2a7a730598d416088b47f5372b8f6df.pdf?index=true
    • https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_3b14c1bc43ac4be3a5a4b17ac3611a92.pdf?index=true
    • https://cdd249b8-77b1-4a94-b024-8995efe4d959.filesusr.com/ugd/d394ff_99ddd418e3d1454ab843a4ad6c8172eb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a4ee189c-a8e8-4122-b108-c8b998d58e53/5_importance_of_curriculum_evaluation.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1b9.bin
1e4fc6e5a15102f882fcb8fe5cc405a5a96793bda09cd22d3b8730a3dbd77923		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1B9 5308 bytes
font_01_sfnt_off0000e3b2.bin
7d4191f454733d0ba12b9944a5e61bca88199a6b4f07626b3ef40dd37a6cfba8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3B2 11092 bytes
font_02_sfnt_off000109a9.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109A9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.