Malicious PDF — malware analysis report

Static analysis result for SHA-256 be898742bcf950b5…

MALICIOUS

PDF

76.9 KB Created: 2021-03-20 18:36:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 19f38230e2a09f73d07707f014395533 SHA-1: 94204b047282ac6a17f14d0ff556d2e608e9f807 SHA-256: be898742bcf950b5562c7a088da85db87316b962f494667a0777ea1019d1b1c1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for ClamAV detection. An external URI, 'https://jumiwimov.ru/wix?keyword=flout+the+rules+of+propriety', was extracted, indicating a likely phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a legitimate document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=flout+the+rules+of+propriety
    • https://cdn.sqhk.co/lukulobu/e5gieJI/umc_el_paso_address.pdf
    • http://migriruy.ru/how_to_get_cpr_and_first_aid_certified_onlinepgbx4.pdf
    • https://cdn.sqhk.co/kifuzopeko/rjjh7ig/76482291432.pdf
    • http://winoorama.site/678867275555htfs.pdf
    • http://fakutuzogazu.sportsontheweb.net/70628052841.pdf
    • http://biweekamnf.com/celebrate_recovery_lesson_16_questions8gj75.pdf
    • https://cdn.sqhk.co/zuxifobiro/jjhap3l/kexabebivod.pdf
    • http://fitdieta.com/dungeons_and_dragons_monster_daily_themed_crossword7u2w7.pdf
    • http://zexaribamemavi.sportsontheweb.net/pikaxowex.pdf
    • http://cartest.pro/33170826846vggwp.pdf
    • https://cdn.sqhk.co/zajujinul/VgjFr69/neruvulidosuzopanopemesis.pdf
    • http://tuduvodakep.mypressonline.com/68035543887.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nitajosasa/71434247147.pdf
    • https://0eb00d84-361a-45dc-b346-1af5c8eb785c.filesusr.com/ugd/d79848_fa883455b55f42ff861a6b678b70afce.pdf?index=true
    • http://kewevagisugimuw.onlinewebshop.net/what_happens_to_bonds_when_the_stock_market_falls.pdf
    • http://dumufal.rf.gd/the_lightning_thief_summary_chapter_4.pdf
    • https://s3.amazonaws.com/negonanopix/sheet_metal_cladding_nz.pdf
    • https://6baea7ca-81e4-4a11-8410-716433a99462.filesusr.com/ugd/764aaa_955d59f6522d4f5f930584753a1ef3b4.pdf?index=true
    • https://s3.amazonaws.com/dazovosugev/ysaye_violin_sonatas_sheet_music.pdf
    • https://s3.amazonaws.com/sefabe/decimal_word_problems_worksheet.pdf
    • http://damewanobojojo.rf.gd/citadel_investment_group_annual_report.pdf
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_96ffe3e952b244709f75b85782934cdd.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e87a.bin
2ecaaf09598996f9f6693567fb3c9b5184be0f4ca067238f54d3f3c53ef1dbb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE87A 4836 bytes
font_01_sfnt_off0000f8f2.bin
de9ddf87bd7ae4a11f0caca651e98f252dbc5abffc15910317d2d5cfc088e1b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8F2 13720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.