Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0f32d5910807806…

MALICIOUS

PDF

99.4 KB Created: 2021-03-17 13:40:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8de091b8788596517a4cd7666e77c66 SHA-1: d963d2e3c67eee455be2a8170ca3abe3cce95905 SHA-256: e0f32d591080780657fabf7a1c975921d102390fcbf57bd989124a98cb18d382
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for phishing or SEO spam. The primary URL, https://jumiwimov.ru/wix?keyword=pearson+envision+math+grade+5+pdf, suggests a lure related to educational materials to entice users to click. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=pearson+envision+math+grade+5+pdf
    • https://vixagukire.weebly.com/uploads/1/3/4/3/134364056/nipus.pdf
    • https://cdn-cms.f-static.net/uploads/4471091/normal_604513bdefd40.pdf
    • https://cdn.sqhk.co/rojarimeg/iM5JoVs/99790271892.pdf
    • http://moshon.space/what_3_things_is_meat_composed_of8mkn9.pdf
    • https://cdn.sqhk.co/gebitasixa/bjihbjg/iphone_photos_tv_wifi.pdf
    • https://cdn.sqhk.co/kojanakif/GGlgfhd/lofedibakovofaki.pdf
    • http://beremoter.online/book_of_giants_full_textxon1b.pdf
    • http://hayatevesigar.online/amarnath_ki_amar_katha91han.pdf
    • https://cdn-cms.f-static.net/uploads/4382779/normal_6042da324690e.pdf
    • https://cdn-cms.f-static.net/uploads/4479684/normal_5fdbfa933cf9c.pdf
    • https://static.s123-cdn-static.com/uploads/4423171/normal_5fe3978d778b0.pdf
    • https://cdn.sqhk.co/buxifuludo/dS6xdV5/r_type_final_ps2_cheats.pdf
    • https://cdn.sqhk.co/xajigekus/qiihgjK/wazilelinigasamufari.pdf
    • https://gixinizolovuz.weebly.com/uploads/1/3/5/3/135348456/gagodanapivumuvuviwi.pdf
    • https://samabuwe.weebly.com/uploads/1/3/0/7/130739499/ramogusubaxepewik.pdf
    • https://cdn.sqhk.co/fezifenax/ZMhjMJg/sniper_gang_keychain.pdf
    • https://cdn.sqhk.co/fekerepusa/zha39F2/sebawubudej.pdf
    • http://evromotors.net/larson_edwards_calculus_9th_editionkaarj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_e32a3f60ce0c4d0bbae54b7220b9d038.pdf?index=true
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_77a93cc107fc4eed9165d977e4fa6454.pdf?index=true
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_4712db3b703e42e8a9facd20c78ab7c2.pdf?index=true
    • https://907864b8-ab38-4b43-b195-7646ee37c451.filesusr.com/ugd/c4b402_8c28c6501837422c9870bce378fe5b5e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d6a.bin
3d4760ca295192c89086870ebbac49c5a5945404ea6ab57fca452cf2db5f569a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D6A 6440 bytes
font_01_sfnt_off00012d5e.bin
0c63da00781613d5d1473e14953ab3030c56eea0a8f29312b0f4bb01919274bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D5E 5608 bytes
font_02_sfnt_off00014057.bin
4b0dd03d42ed25f7267ad83ed858f7bd782a7c79187453cd32d96c6ea2f72161		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14057 12596 bytes
font_03_sfnt_off00016a34.bin
5012b9ee8c60688706efe5c3097a3abd618270bed3b9b887c577957632945bce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16A34 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.