Malicious PDF — malware analysis report

Static analysis result for SHA-256 f603dfaf1efb47e2…

MALICIOUS

PDF

85.5 KB Created: 2021-03-18 23:20:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8ff0ea553f651c10e7eeef3b980fb7ed SHA-1: 273d2e6ff7648639ac887e20b848bd45f7f3c793 SHA-256: f603dfaf1efb47e2ba692d0d7b15c3979ba69f41e2a323ee695aa5895b99066e
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an external URI pointing to 'jumiwimov.ru', which is likely the download source for a secondary payload. The document body, though heavily obfuscated, suggests a lure related to a 'Call of Cthulhu RPG PDF' download, aligning with a phishing or social engineering attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=call+of+cthulhu+rpg+pdf+download
    • https://cdn.sqhk.co/bomoxale/Tjdifii/vefuw.pdf
    • https://cdn.sqhk.co/lojadisexudo/oIjhDkG/pexobubome.pdf
    • http://tosefabebiribow.scienceontheweb.net/best_math_sat_prep_books_2020.pdf
    • http://sekujirimabasas.getenjoyment.net/september_2020_calendar_download.pdf
    • http://jexekiraj.sportsontheweb.net/frigidaire_dehumidifier_repair_manual.pdf
    • https://cdn.sqhk.co/luxixumogez/gcBygiv/71055506579.pdf
    • https://cdn.sqhk.co/pavujakorige/5gjuwhe/bounce_classic_game_download_for_android.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jotogorurekuro/40105446840.pdf
    • https://s3.amazonaws.com/tosego/22218311560.pdf
    • https://s3.amazonaws.com/niwotipugonuvoz/where_to_drop_off_old_clothes_near_me.pdf
    • https://uploads.strikinglycdn.com/files/e9f537ea-a9a6-417a-9e29-ff5cd7c4ec67/sat_study_book_2020.pdf
    • https://s3.amazonaws.com/lorifumofelu/98536223904.pdf
    • https://uploads.strikinglycdn.com/files/750138c0-c0c2-43ff-8bd2-3682b8a4441d/starbucks_barista_pay_virginia.pdf
    • https://s3.amazonaws.com/bulujono/79479840883.pdf
    • https://s3.amazonaws.com/kifutizijebuj/93023543094.pdf
    • https://s3.amazonaws.com/guvovigo/pudem.pdf
    • https://uploads.strikinglycdn.com/files/ca751297-40e8-4483-a336-4775b563dd59/42310275366.pdf
    • https://s3.amazonaws.com/sonutopexaramuf/43915269387.pdf
    • https://uploads.strikinglycdn.com/files/8c6f8dce-3cdf-4f02-9abb-b64708fa50f8/83332941945.pdf
    • https://uploads.strikinglycdn.com/files/b329e56f-6624-4f9c-a87b-294c3176aa98/39437335432.pdf
    • https://uploads.strikinglycdn.com/files/1fe931e8-12b7-446e-8d85-ed322fea3d04/99842230025.pdf
    • https://s3.amazonaws.com/zobuwubedak/miller_thunderbolt_225v.pdf
    • https://s3.amazonaws.com/negonanopix/lg_tromm_washer_and_dryer_cost.pdf
    • https://uploads.strikinglycdn.com/files/e172fc00-1efc-48fe-9eed-2d63eb232aea/77738480670.pdf
    • https://uploads.strikinglycdn.com/files/10165c60-2202-469e-9211-22a3bb48d936/solution_set_example.pdf
    • http://bitines.myartsonline.com/how_to_play_double_diamond_slot_machine.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010721.bin
e7c56e98dbc035b4c320830bd50a256cd2c12553be87745e1c053db1b550c6fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10721 5236 bytes
font_01_sfnt_off000118f5.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118F5 1800 bytes
font_02_sfnt_off00012182.bin
2b3f50570cca0c2627bd81ce3554bb50a5bdb4b29ad37c4296d61568828ef22f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12182 11312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.