Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6cbf0d339669c2b…

MALICIOUS

PDF

87.2 KB Created: 2021-03-29 00:26:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1d663699552163b8677ad42ecfda6861 SHA-1: bbd0b3c1aba3ad0134542eb5aa5bd55b00aae7f6 SHA-256: d6cbf0d339669c2bae8f4059dc3175c46fef12717ae64e09f3215bfce75be161
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document contains numerous external URIs, with a primary one pointing to 'https://jumiwimov.ru/wix?keyword=living+environment+regents+january+2015+answers', suggesting a phishing or scam lure. The presence of many distinct hosts and links indicates a link farm designed to obscure the true destination or spread malicious content across multiple domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=living+environment+regents+january+2015+answers
    • https://static.s123-cdn-static.com/uploads/4465548/normal_5ffe8ecc829cd.pdf
    • https://cdn.sqhk.co/nadetajagupe/iahanie/plum_chutney_recipe_pakistani_in_urdu.pdf
    • http://gexomafe.mypressonline.com/44128825956.pdf
    • http://soldatskaya6.ru/will_there_be_a_4th_fifty_shades_of_grey_bookyt28h.pdf
    • https://static.s123-cdn-static.com/uploads/4372987/normal_5fcaa86b0b794.pdf
    • https://cdn-cms.f-static.net/uploads/4499673/normal_6060f31ec7294.pdf
    • http://abwaab.su/nijawimudilavanasuvawepip2qko.pdf
    • https://static.s123-cdn-static.com/uploads/4446770/normal_5fccb61abed39.pdf
    • http://biniwitovo.mywebcommunity.org/how_do_i_make_a_wordle_cloud.pdf
    • http://povar2020.site/995148062776qtvi.pdf
    • http://arthromedro.xyz/jojokapepomts9m6.pdf
    • https://static.s123-cdn-static.com/uploads/4447108/normal_5ffdd14f5d065.pdf
    • http://autobaff.xyz/mozekoxelovunizex9200.pdf
    • https://cdn.sqhk.co/vasozaponem/ije1iah/minecraft_xbox_360_modern_house_map_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tikeresepujel.onlinewebshop.net/kazipigal.pdf
    • http://wipadafefuxasi.onlinewebshop.net/5015748450.pdf
    • https://uploads.strikinglycdn.com/files/d871e83d-647d-4ec0-b83c-49da2c76b607/dufosezab.pdf
    • https://uploads.strikinglycdn.com/files/fdc2779d-2cef-447c-ae6d-770fcb8a614f/90370301670.pdf
    • https://uploads.strikinglycdn.com/files/df377ab6-8502-444d-9c51-d9903810d053/2330103458.pdf
    • https://e0f910ba-f4aa-4d6b-87f6-24d78cda99ab.filesusr.com/ugd/cc15ef_98d25007f09b4112b93b4dfdbc944e4d.pdf?index=true
    • https://edcb5511-827b-40b0-97c1-3499c313f96b.filesusr.com/ugd/0779a3_c1888169ca60464cbb633ac984ea2588.pdf?index=true
    • https://de7eff9d-5c50-4122-bb99-ee112abf7a8f.filesusr.com/ugd/db8f21_dbc762b2b6d64f4aa079eff90cc9db7d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000114bb.bin
fc78d36b2be31173f5b719259f763fa37f2a816f56c6b08afa8ba37a240695c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114BB 5692 bytes
font_01_sfnt_off00012838.bin
f9da07825d471e8b7f1ff8e6ef90041cdd61fdae99b2941509fab26363bdef77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12838 11484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.