Malicious PDF — malware analysis report

Static analysis result for SHA-256 e81214004d405612…

MALICIOUS

PDF

73.1 KB Created: 2021-06-02 09:20:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: ffeccaeb4c5ae0cf3c743519bcfca72d SHA-1: b552b49104a95fca579a973c961628190ecc6c41 SHA-256: e81214004d405612e06cfd7d5386b8cbb8e0324267257edac4ce00363e9f420c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'inwebjor.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests it is related to 'Praxis test study guides', a common lure for educational or professional certification scams.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9742

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=praxis+test+5354+study+guides PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4379231/normal_60062adde0a34.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486350/normal_5fdf627e4066c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370309/normal_5fde7ca3bb7c8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500670/normal_5fc7588c67b10.pdfIn PDF document text
    • https://xedatuvigino.weebly.com/uploads/1/3/4/5/134580066/9508639.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445739/normal_60399ec31734e.pdfIn PDF document text
    • https://folimero.weebly.com/uploads/1/3/2/6/132695744/gubazadofisivu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481418/normal_602d040ff0274.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499023/normal_602f9a316929f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490122/normal_604d3d18a413f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449618/normal_5fc604cae5687.pdfIn PDF document text
    • https://takewozijofu.weebly.com/uploads/1/3/2/6/132682119/mizezimisuna.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mikabipi.pbworks.com/w/file/fetch/144437379/spectrum_rc122_remote_codes.pdfIn PDF document text
    • http://zigunef.pbworks.com/w/file/fetch/144444276/how_to_calculate_isotopic_abundance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e29b6ece-fdb9-467b-a2ef-90f46df55456/what_is_the_gothic_architecture.pdfIn PDF document text
    • http://funinupun.pbworks.com/w/file/fetch/144427140/10_oraciones_separado_sujeto_predicado_y_verbo.pdfIn PDF document text
    • http://bujolajoxek.pbworks.com/f/mazikafimivegegenaxuki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16dc0d5a-59d2-4561-8721-e8f8c39aa5ee/25399114858.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f219e9dc-2abf-4744-b425-52ac2ebaa860/what_living_thing_has_the_most_cells.pdfIn PDF document text
    • http://joxupakager.pbworks.com/w/file/fetch/144490254/nenisogusukoxejumeguxitu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be97512d-eed0-4c8a-ae60-3b5b9cd0be0d/94654448952.pdfIn PDF document text
    • http://joxupakager.pbworks.com/f/how_to_change_notification_tone_on_snapchat.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB5C 5508 bytes
SHA-256: 604f01ad281fbbbbad9a0df3a16199cf353e514ee0e5c1c9d61802ee1e45b244
font_01_sfnt_off0000fe40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE40 10940 bytes
SHA-256: 957bb48b0e3076a00aca0cd214d1b4f23817407e7b01cba2145964f74092b7fb

Open this report in the interactive analyzer, or submit your own file for analysis.