Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9bd9d10329e7976…

MALICIOUS

PDF

102.0 KB Created: 2021-04-07 15:38:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 842d9beb7596e332b152069c712bfcb7 SHA-1: e902c67bc1f0b152f962ded139f4919f31100214 SHA-256: d9bd9d10329e79769669934a66cb20e896f420d5be35956a60f1f05fda2ef544
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://jumiwimov.ru/wix?keyword=clarks+auto+sales+lakeview+mi', which is likely a phishing lure or a distribution point for further malicious content. The document body contains obfuscated text and metadata related to the PDF creation tool, but the primary threat appears to be the external URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6004

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=clarks+auto+sales+lakeview+mi
    • http://peromopativej.mypressonline.com/enlightenment_now_graphs.pdf
    • http://babysampler.com/the_new_york_times_company_ceoxl3gk.pdf
    • http://cartest.pro/gartner_siemqed1q.pdf
    • http://zuwazekanusur.mypressonline.com/california_residential_lease_application.pdf
    • http://xupulakikovuxo.mypressonline.com/how_much_is_a_briggs_and_stratton_engine.pdf
    • http://forajadafogaxuv.medianewsonline.com/36894994368.pdf
    • http://devedilazabu.medianewsonline.com/robejubupesurexip.pdf
    • http://nanebaxexob.getenjoyment.net/99114697491.pdf
    • http://usecabinets.xyz/free_willy_4_full_movie_tamil_dubbed_downloadqz6x9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pomisukiso.rf.gd/amoxicilina_xarope_bula.pdf
    • http://pedirite.onlinewebshop.net/73573979347.pdf
    • http://wuxodiza.epizy.com/tewazakufigebilale.pdf
    • http://pozidatizoza.rf.gd/apsrtc_bus_pass_application_below_ssc.pdf
    • http://gasukexopesifu.epizy.com/25320733039.pdf
    • http://lovekegikowuf.rf.gd/agile_software_development_robert_martin_download.pdf
    • http://xevijojikutep.onlinewebshop.net/basics_of_technical_communication.pdf
    • http://dominomufu.rf.gd/wills_eye_manual_new_edition.pdf
    • http://lojibovel.myartsonline.com/a_posteriori_knowledge.pdf
    • http://sidakofonol.epizy.com/oxford_bookworms_audio_mega.pdf
    • http://jumepenitujox.atwebpages.com/what_age_group_is_the_three_little_pigs_for.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015ed0.bin
72c60f2dde343e9bd11463bf682ae96dd253b8425e2de9aa9b0ad848d3baf8da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15ED0 4952 bytes
font_01_sfnt_off00016fa2.bin
168e26a0d180c5c7f2404a14218f65f81c3d2a47bdeba7d8cc56bd3827696a23		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16FA2 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.