Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2cabb578d0feb60…

MALICIOUS

PDF

179.5 KB Created: 2021-05-27 16:55:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c3b9312ef313b6a4a7025eb1df02894c SHA-1: 89a05fc5e393256a2e9ac12d8f7eb7da6e16d2a4 SHA-256: e2cabb578d0feb603462431d719360c3192792195abf55a947fbed9166b75c8e
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was identified as malicious by ML classifiers and ClamAV, with heuristics indicating it's an advance-fee scam lure. The document body, though heavily obfuscated, suggests a deceptive pretext related to a book summary. Embedded URLs point to external sites, likely serving as the next stage for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=fahrenheit+451+part+1+and+2+summary
    • https://pamukisap.weebly.com/uploads/1/3/4/7/134761215/konijuvisejamari.pdf
    • https://fibetenozogu.weebly.com/uploads/1/3/0/8/130813768/63837c.pdf
    • https://bixuduserar.weebly.com/uploads/1/3/4/8/134861961/dinexoxunek.pdf
    • https://tinubuwetoka.weebly.com/uploads/1/3/5/3/135325034/jikamev-kazapov.pdf
    • https://madoguwulivusi.weebly.com/uploads/1/3/0/7/130775056/bd7c904.pdf
    • https://tevufipe.weebly.com/uploads/1/3/1/6/131606546/dazafope.pdf
    • https://jofetafoba.weebly.com/uploads/1/3/4/4/134485710/3fdf85f4d2d5.pdf
    • https://figiroxofidun.weebly.com/uploads/1/3/0/7/130740151/79879b.pdf
    • https://bewimowijukoja.weebly.com/uploads/1/3/4/5/134584545/wazazikafi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/92d9577d-a927-40ea-a3a6-5c08969e062c/tax_free_wealth_book_companion_files.pdf
    • https://uploads.strikinglycdn.com/files/c38148f8-d530-4f3b-a2d5-0a28149ae6c4/ruziwotif.pdf
    • https://uploads.strikinglycdn.com/files/e7ddc0fa-31a4-468b-9b24-768029aaef4d/zejulimamizoratavuf.pdf
    • https://uploads.strikinglycdn.com/files/126cb6c0-9b65-4ff7-bba8-df7a9e6f7d54/gawiganiwebejepagifap.pdf
    • https://uploads.strikinglycdn.com/files/844c8a72-eab5-4c49-8384-7546336bd478/78372461452.pdf
    • https://uploads.strikinglycdn.com/files/5c0264b1-5be8-4c80-ad87-97ff54e7b56a/theory_of_relativity_musical.pdf
    • https://uploads.strikinglycdn.com/files/5264151f-2bbc-477a-b42f-5186460a2501/how_long_does_propane_tank_last_in_mr_heater.pdf
    • https://uploads.strikinglycdn.com/files/d755a6f1-da16-4091-a72e-06947b1542f6/lozuwobijadimuf.pdf
    • https://uploads.strikinglycdn.com/files/c9c9b323-367b-4334-a538-a0688d5f1993/husqvarna_235_chainsaw_chain_oiler_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/8c9fe363-404c-410f-b10e-3141ab6a5321/three_day_potty_training.pdf
    • https://uploads.strikinglycdn.com/files/d1732c02-120b-4fce-8d1c-7fdb4c05800e/31385245839.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00026bcd.bin
ff172ae960f4ec2059e5cf8c9d91f0df0d661211dc0263878194fe1031af5023		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26BCD 5620 bytes
font_01_sfnt_off00027ed9.bin
7674369ee31f4a5e59c11a87b3877f92d34de6d379ba970f5f95ad6dcdd60b9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27ED9 13116 bytes
font_02_sfnt_off0002a991.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A991 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.