Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfc2e5183c1bf55b…

MALICIOUS

PDF

109.7 KB Created: 2021-03-31 18:51:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 57032af038c448c3c4781d468cb6a947 SHA-1: 97e4428ef305066689ecdf9e97ff3e66832d4116 SHA-256: cfc2e5183c1bf55bf7ef290ee9fccbc15b6f3eda97187c03b957a472903085de
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an embedded URI pointing to 'jumiwimov.ru' suggests a phishing or malware distribution attempt. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document may be part of a multi-stage attack involving password-protected archives.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=paises+que+conforman+africa+septentrional
    • https://cdn.sqhk.co/jasurisunav/haB8rhi/amat_stock_earnings_report.pdf
    • https://cdn.sqhk.co/sigidezok/2Rsxwjg/cordiality_part_of_speech.pdf
    • https://cdn.sqhk.co/totarujined/jehjge6/affordable_bed_sheet_sets.pdf
    • https://cdn.sqhk.co/vovomafejuwa/Whdgj21/fire_retardant_plastic_sheets.pdf
    • https://cdn.sqhk.co/vatopibar/jbic3pp/planet_waves_ns_micro_headstock_tuner_manual.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d7ce152f-438c-444e-b655-8400ab34a637/stephen_king_the_mist_series_netflix.pdf
    • http://banezisiwirasu.rf.gd/kw_listing_presentation_template.pdf
    • https://uploads.strikinglycdn.com/files/915c52ee-8a94-4ceb-b934-c2e3e5dddfbe/how_to_print_entire_dataframe_in_python.pdf
    • https://uploads.strikinglycdn.com/files/0349b342-1952-4a9b-8601-3a9bcc38e734/vepajobepubogiterebupojo.pdf
    • https://s3.amazonaws.com/remavuj/linekolepezen.pdf
    • http://rapixojudod.epizy.com/mckay_building_construction_volume_1_free_download.pdf
    • https://uploads.strikinglycdn.com/files/508a0340-7b37-45a2-b774-536834925498/how_many_questions_are_on_the_texas_master_electrician_exam.pdf
    • http://gidepajujida.rf.gd/pexunozedenitukonegofi.pdf
    • https://uploads.strikinglycdn.com/files/2d3c31ac-fb98-42ce-8001-b0e49d613ee9/why_are_ranger_boats_so_expensive.pdf
    • https://s3.amazonaws.com/liwara/action_plan_template_school_improvement.pdf
    • https://uploads.strikinglycdn.com/files/df079068-5457-450a-9bb3-6db2beb98ede/dufokizeraxewudasineza.pdf
    • https://uploads.strikinglycdn.com/files/035cd189-c966-40be-b1ad-e5ef18949076/13608340730.pdf
    • https://s3.amazonaws.com/kelageketisefuv/77040546231.pdf
    • https://uploads.strikinglycdn.com/files/a9c9b848-5bf6-4e8d-ac54-63eec5374d23/felej.pdf
    • https://uploads.strikinglycdn.com/files/2e637d0e-5466-4d28-8660-03d3f39f196f/dream_meaning_of_dead_siblings.pdf
    • http://piwuzodoxomox.epizy.com/41308400674.pdf
    • https://uploads.strikinglycdn.com/files/3074d8f9-7176-4e86-983a-0be2e73edf85/kixugu.pdf
    • https://uploads.strikinglycdn.com/files/88c3f323-1329-4efb-ae9d-b15ed901cbe8/getelofanixininijegu.pdf
    • https://uploads.strikinglycdn.com/files/b7598f12-7032-494b-9ad2-a2c22b9c9ff3/hampton_bay_ceiling_fan_replacement_blades.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014f0f.bin
8ba95b3698a395ffe5a6c028a48b141690ceafb80f4119b350b4bc78655a3827		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14F0F 5288 bytes
font_01_sfnt_off000160fc.bin
6d6670f6eeb69a542f0069b5eba5245f478b6c90657411237ceec534165422d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x160FC 14236 bytes
font_02_sfnt_off00018d01.bin
c64b1521532a60a937c8d7be4582270db69e118fbbe4d8037af3c760122ddfe1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18D01 17540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.