Malicious PDF — malware analysis report

Static analysis result for SHA-256 40397ed58cb12946…

MALICIOUS

PDF

80.3 KB Created: 2021-03-23 16:53:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 28d97d8bc6f910560e4cb4a56d2b8a7f SHA-1: f0b0cc776cf41c21744c6935c926eaf43a20c164 SHA-256: 40397ed58cb129464978fd960fd3859376fd26f76f4df3293ddb1730a5cf78f4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL pointing to 'jumiwimov.ru', suggesting a phishing or scam operation. The document body, though truncated and obfuscated, contains text related to food safety, likely used as a lure. The presence of PDF-specific heuristics like 'PDF_SEO_LINK_FARM' further supports the analysis of a link-farming or redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=can+you+eat+cooked+chicken+cold+after+defrosting PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4485572/normal_601a5703876f1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456376/normal_5feecdfe31948.pdfIn PDF document text
    • https://cdn.sqhk.co/pagupuxu/Ljg5hcw/wurorusegojovesejomejum.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421200/normal_6014e19675224.pdfIn PDF document text
    • https://cdn.sqhk.co/madagijoj/ZJhshhi/auto_mechanic_salary_texas.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4375703/normal_5fd060978e5fb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383452/normal_6005522eef034.pdfIn PDF document text
    • https://cdn.sqhk.co/veletafi/bvBIgjq/fitiwavuguxawi.pdfIn PDF document text
    • https://cdn.sqhk.co/lebudawojafi/EHFGhan/katijevulifoxik.pdfIn PDF document text
    • https://cdn.sqhk.co/mekurapiw/hdhiihF/hokey_pokey_elmo_youtube.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383918/normal_60290d72878e7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/saziwijaxodav/imbuement_guide_tibia.pdfIn PDF document text
    • https://167c2301-eccc-4e3a-a609-38a4f17b9bf8.filesusr.com/ugd/b1dabf_dd8949b683c546d09beb17755a8d7b4e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/begijufadi/introduction_to_geometrical_optics.pdfIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/little_red_riding_hood_summary_story.pdfIn PDF document text
    • https://1347de4c-4e54-429a-b84c-372e60bc5a2b.filesusr.com/ugd/6c98bc_b3e6ce052c7f4a6d9034b0961719eaca.pdf?index=trueIn PDF document text
    • https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_d7e25343591f4e19aa4de5ee2056dbbf.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rojalexipokadaz/diagnstico_definicion_informatica.pdfIn PDF document text
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_3f250d7188db4702a8de95b726c4d793.pdf?index=trueIn PDF document text
    • https://e39bfc17-a898-4016-ac91-fc9303c112df.filesusr.com/ugd/b5068a_f324a9f7c9804ebfa4571a1ca1f8bc78.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/muwomapotumugi/wuwozofaka.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e794.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE794 5356 bytes
SHA-256: aafc5677391dfe8912138e418d3bd4ef753b7b6665f69b2aa8c145c8c608d410
font_01_sfnt_off0000f9cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9CD 10872 bytes
SHA-256: 8c3eb3ec0059dfc0d8b3aa9fe2205a8b7e47dce004a09973838613b9cd0f949c
font_02_sfnt_off00011ece.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11ECE 16036 bytes
SHA-256: 354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb

Open this report in the interactive analyzer, or submit your own file for analysis.