Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef1284653fc9f5ba…

MALICIOUS

PDF

75.6 KB Created: 2021-03-21 00:50:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: efa067addc9562c7ef0ef884ec9d53fe SHA-1: d547853b63ebda4a846b76197d1f23daf4a8c910 SHA-256: ef1284653fc9f5bad9b146f571fa6e4a1912553d5e7053982601cff3ecec9148
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. An external URI pointing to 'https://jumiwimov.ru/123?utm_term=yii2+response+json+format' was extracted, suggesting the document's purpose is to redirect the user to a potentially harmful site. The presence of PDF-specific heuristics further supports its classification as a malicious PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=yii2+response+json+format
    • http://prod-fruit.space/capresso_burr_grinder_585_manualj17dc.pdf
    • http://nemagufi.mywebcommunity.org/aguas_de_marco_tab.pdf
    • http://fenellalucynelle.info/what_is_the_price_of_smart_watch_in_indiagiezg.pdf
    • http://xorudaz.iblogger.org/does_bushnell_binoculars_have_lifetime_warranty.pdf
    • http://duwudivusupo.mygamesonline.org/what_is_an_example_of_a_body_paragraph.pdf
    • https://cdn.sqhk.co/komilede/yohj4gh/21346272406.pdf
    • https://cdn.sqhk.co/puxezuxivas/aji1osE/tativafojabunenuwi.pdf
    • https://cdn.sqhk.co/pimabosi/aMhcfye/72992198386.pdf
    • http://uscreditcheck.info/9744376544829igh.pdf
    • http://gukabibus.mygamesonline.org/sakolelipigosafuxegiw.pdf
    • http://nojejolewowutes.22web.org/brunner_and_suddarth_14th_edition.pdf
    • http://sitizinudex.getenjoyment.net/bitepujisek.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dapuvutajula.rf.gd/california_rental_agreement_in_spanish.pdf
    • https://84bd2c60-91d0-47b6-9565-6ae8a6593e58.filesusr.com/ugd/963627_9bd51fb3017c4bec9c6d5f334105f6e7.pdf?index=true
    • https://s3.amazonaws.com/pulavokaxe/89322411609.pdf
    • https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_01573ecc4a894add826a10d259499d19.pdf?index=true
    • https://c06d174a-caca-4ab2-b5a0-4525cd3135d4.filesusr.com/ugd/856cea_6cd1dbe6a21246be9b65239a372b0b9a.pdf?index=true
    • http://tafujeloraxofo.epizy.com/jegosupiwuxusisepirufuno.pdf
    • https://409b2d23-5c1d-402e-97df-26c0da9299b0.filesusr.com/ugd/2e3d42_c32f6609998744f2922d791a8cafcf86.pdf?index=true
    • https://s3.amazonaws.com/pazovugal/fibuxigajobibudomesemej.pdf
    • http://tokafibalo.epizy.com/62915781909.pdf
    • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_309d54f464154d4d9e6146c46326be2b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e803.bin
1f3815206a9073206717ff1d854ee79cf401ee9d9c09bde88a3a9e98fb1e61df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE803 5184 bytes
font_01_sfnt_off0000f994.bin
cf4976773a1bb2c55693c86055bb360ce74a758eee2f73cd843cf30c84c236f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF994 11608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.