Malicious PDF — malware analysis report

Static analysis result for SHA-256 94eab737856e9310…

MALICIOUS

PDF

74.3 KB Created: 2021-04-16 03:40:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: a246436e546b10b6b050aec071356d5a SHA-1: 906a6167463defb45f8746a7f7339d49daecabfd SHA-256: 94eab737856e93104f2d2fe1b3c3b48b12ecdde2f925186a7eca4051a114d942
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An external URI pointing to 'gimoguvi.ru' was extracted, suggesting a phishing or malware distribution attempt. No scripts were extracted, but the embedded URL is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=john+maxwell+leadership+center PDF link annotation
    • http://clientesdkb.com/flowers_in_the_attic_1987_original_endingzuv26.pdfIn PDF document text
    • http://tadugebakonuged.getenjoyment.net/berlin_subway_map_english.pdfIn PDF document text
    • http://woodbonus.net/22183553512nnlia.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f67ded3-f397-4ea9-b9dc-d72eb0605e0e/how_to_determine_level_of_care_substance_abuse.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8eee1fc-8a7b-4ca1-b8c3-db033cfb15ed/romeo_and_juliet_text_act_1_scene_5_summary_tybalt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fdf851ee-56ea-4200-8e94-cb79f43004b0/god_chasers_lyrics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fe35ec2-1c78-4cd8-8afa-2d0cf7f3e84c/feragudagosukulajek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bcf5ab3-1bb0-4646-9e49-6a632e9bc9df/can_you_lose_weight_on_anti_inflammatory_diet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fee6325f-b96d-4f35-8ee3-c1eeed1437ca/garmin_forerunner_410_strap_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2aa2b384-8752-40b8-bf76-96399b01ec91/photoscape_x_download_windows_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb84bbaa-64fd-4552-8d92-4ec7f5cd2347/xuzodokaso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0a599ef-8d23-4f30-b3b6-6ad82388a5a3/what_is_the_text_structure_of_the_passage.pdfIn PDF document text
    • http://lojibovel.myartsonline.com/blocs_wave_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7edb753d-4598-4477-ba6d-10c6e57ea8be/financial_management_theory_and_practice_15th_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b2aae83-3c97-4b20-ae8c-13217561ecfa/wawijefag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b76552cf-2ebc-492e-96b9-2f6acffe7d6d/is_black_positive_or_negative_on_jumper_cables.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6fe17de7-31db-4c75-b4cc-90e0d7c44e94/fuzimurin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ffd05c3-9c00-4648-8a6e-66501155962e/chamberlain_liftmaster_professional_1_3_hp_garage_door_opener.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e431.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE431 5460 bytes
SHA-256: b53a1a036fbf5f3331553364fd1684ca745343d686449f1ec3a9a0afed380a38
font_01_sfnt_off0000f6a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6A7 11084 bytes
SHA-256: 597c295dfcd2287343524fb785167bd82f6ab0e66aa35d09ae44c9d20bf898e5

Open this report in the interactive analyzer, or submit your own file for analysis.