Malicious PDF — malware analysis report

Static analysis result for SHA-256 c441a63c3d498fb0…

MALICIOUS

PDF

80.5 KB Created: 2021-05-20 01:53:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: c2b91032ad98c1767f6926debc2eec99 SHA-1: aa50e95224c496e78bfb5741f50b684a3622cc22 SHA-256: c441a63c3d498fb057523487747a0b546e3d5a9e5d69d34973939b76d063e762
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'jumiwimov.ru', which is likely used to host a malicious payload or phishing page. The document body, though partially corrupted, suggests a lure related to leadership concepts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=key+components+of+transformational+leader PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4420924/normal_6005921a654b3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4407795/normal_5fecf5854ea19.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489732/normal_5fd3851b9256a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407085/normal_604371a597955.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487916/normal_603a5e66e166b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484605/normal_5fd2d28747cf1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480590/normal_60247648ee875.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/sizabo/76134730049.pdfIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/cowl_neck_dress_template.pdfIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/36976081905.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60aebac4-ba90-4d88-89ce-5290fa504f85/how_to_design_a_brand_name_logo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9798929e-3866-4ecb-bec5-6bfefd9e4ff6/semoruwu.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/b._ed_psychology_books_in_telugu.pdfIn PDF document text
    • https://s3.amazonaws.com/girilifawuxi/the_family_man_movie_hd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6f8b3da-6fbf-4d57-92b3-7fd7ab68d3a8/how_to_use_the_dell_active_pen_pn338m.pdfIn PDF document text
    • https://s3.amazonaws.com/liluvad/kazesaxabo.pdfIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/jumuloroxovadug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad83de80-9888-4529-b35c-c45f06112e8a/camp_group_games_no_equipment.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1fbaafd-bb2e-4f2e-8a00-8397ea3436ee/49794303846.pdfIn PDF document text
    • https://s3.amazonaws.com/wozoxub/29990197311.pdfIn PDF document text
    • https://s3.amazonaws.com/tutasujal/cylindrical_waveguide_cutoff_frequency.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c14da5d8-54b8-41cb-ae8a-13036bfe2cab/memory_foam_pack_and_play_mattress_topper.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/febdc61e-34d2-4126-bf4e-0744186f3314/the_world_in_6_glasses.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d2147b2-4ea7-49f1-a45b-ef1c66abbf82/train_going_back_and_forth_video.pdfIn PDF document text
    • https://s3.amazonaws.com/kosipefojaw/penyusunan_dokumen_akreditasi_puskesmas_2017.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA23 5160 bytes
SHA-256: 1bf659918db01336e1fc4e758b451635d3e7fa5e2f99ef5fa23cf5ff49c3dace
font_01_sfnt_off0000fb9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB9B 13632 bytes
SHA-256: e045f57b47e6c137aac3ab4bf39284529157facbe746cf00dc169d2fde44f74f
font_02_sfnt_off00012460.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12460 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.