Malicious PDF — malware analysis report

Static analysis result for SHA-256 96116e1be40cd447…

MALICIOUS

PDF

179.0 KB Created: 2021-05-13 15:16:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2af58ef37bb0b08bd3d34606a55a9738 SHA-1: 878184614e6a669294b79bbeca6d0de20dbe9a7f SHA-256: 96116e1be40cd44783d92df6f46ab5cb33925e02de2c4e40e3dcd99bea063d43
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'jumiwimov.ru', which is likely used to deliver a malicious payload or conduct phishing. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to exploit user interaction for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=irregular+at+magic+high+school+light+novel
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4e190a5a-ef35-4416-b768-67a8478db10d/the_further_adventures_of_sherlock_holmes_audiobook.pdf
    • https://c140f178-ee45-427e-91fe-a3c5f821f67e.filesusr.com/ugd/ebc5f9_0a4e4730514945799835f648e4b553f5.pdf?index=true
    • https://f4a80ce2-0a24-44e2-aff7-13c87a434ee9.filesusr.com/ugd/ace063_ef5a5251f2194214a7c8847e8e5a6938.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4fb2526e-d0e9-49ef-a951-4681b7ebd2e6/37554863183.pdf
    • https://8dfdba76-182f-4dc4-9dda-37a8c8d09dc9.filesusr.com/ugd/4ae4db_bdf5f2c0fc6f464a9df64931d179df2e.pdf?index=true
    • https://2065f6f1-29fb-48ac-a230-4f4ab2d4b746.filesusr.com/ugd/b62953_3b9143d938f148f7939e6bfda7a16746.pdf?index=true
    • https://s3.amazonaws.com/waxapoz/insulated_concrete_form_suppliers_uk.pdf
    • https://76a725e8-946c-4ae9-9249-cda469d35108.filesusr.com/ugd/83c8cc_c6974d04957e4c08a6d9903f41ffea42.pdf?index=true
    • https://uploads.strikinglycdn.com/files/251aba53-93a1-4b2e-8f55-f398090c6a4e/86398999340.pdf
    • https://s3.amazonaws.com/xirixepo/89845313370.pdf
    • https://s3.amazonaws.com/wixatax/guwidinupaxuvikurimadimip.pdf
    • https://s3.amazonaws.com/mipeboro/joxeteki.pdf
    • https://uploads.strikinglycdn.com/files/56a2e82b-c89f-4956-9750-15a0b0d5ff00/bapaluvizetajelozojak.pdf
    • https://99516632-72ce-40f3-a9a1-a01c91361c65.filesusr.com/ugd/e42c35_db38e9049c1b458192e79e9abf0dd352.pdf?index=true
    • https://db244590-af71-4c33-bd6e-2f8f55f31281.filesusr.com/ugd/fdab61_7176a322106d4519a370303b3c66c23d.pdf?index=true
    • https://80b2a579-f9ed-4aa0-b91a-ac3c8973c086.filesusr.com/ugd/353d00_2f6a1101dd8e492a9c70a3e0b01fc96a.pdf?index=true
    • https://b3695a61-a5b7-457a-863f-99677d03e0cc.filesusr.com/ugd/f2a82d_2bb0600908994a6286e22a38a6304dc2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/db4aab50-bc09-4430-b393-b7bee63431d5/what_is_the_pass_rate_for_usmle_step_3.pdf
    • https://s3.amazonaws.com/xomudufe/what_is_the_function_of_the_cones.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001c456.bin
517b15e6f24848efee9ea0f2e0e27a02972eb9be7fe5b54d6203f8a1bd2db4e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C456 63480 bytes
font_01_sfnt_off000283fb.bin
b385890eebefc33e066889449ff092c2a1337b502b6cf81d230ee813a91c404d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x283FB 5208 bytes
font_02_sfnt_off0002958c.bin
b1a5928c05e8bff565f779b60c19c7d3db068f6543f4ad3bb41757f977fc8899		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2958C 12256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.