Malicious PDF — malware analysis report

Static analysis result for SHA-256 40441c037985212f…

MALICIOUS

PDF

68.7 KB Created: 2021-03-11 17:44:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f7f887e4e925eaaebbb111fe3f5c7b85 SHA-1: de9375fc8f0a405e0ba182314860e7b457bea2c5 SHA-256: 40441c037985212f694c97919b889b899ad2cb25b0167bfef19745c95953b550
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are part of a link farm designed to appear as search results for app downloads. The heuristic 'SE_PAYMENT_REDIRECT_LURE' indicates that the document content likely attempts to trick users into believing there are new or changed payment instructions, a common tactic in business email compromise scams. The presence of multiple external URIs and the ML classifier flagging it as malicious strongly suggest a phishing or scamming intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=mega+app+apk+mirror
    • https://cdn.sqhk.co/zarepowake/jiikghn/download_game_kitten_match_mod_apk.pdf
    • https://kaxojolomo.weebly.com/uploads/1/3/4/8/134885197/toribigobifodip.pdf
    • https://static.s123-cdn-static.com/uploads/4490263/normal_5fca9cc855cb7.pdf
    • http://tejowigasinafu.getenjoyment.net/american_born_chinese_essay_topics.pdf
    • https://cdn.sqhk.co/gukokefa/fR0igib/53971717378.pdf
    • http://timinome.getenjoyment.net/3706338708.pdf
    • https://cdn-cms.f-static.net/uploads/4464330/normal_601c685cc465f.pdf
    • https://cdn.sqhk.co/sebixodof/hbYigp3/74199060252.pdf
    • https://cdn.sqhk.co/toxotunem/ii5iajf/10775802909.pdf
    • https://kerimoseb.weebly.com/uploads/1/3/5/2/135299904/jalinebuxoluno.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8ac5c8e1-9174-427d-95c2-90bebb9f105a.filesusr.com/ugd/44b221_25aed8dc600747c88fb22573dae50926.pdf?index=true
    • https://ba3a7bb5-edd2-4228-b29c-cf272df6a868.filesusr.com/ugd/bd1c09_6137448055234005a2f0274682d5e392.pdf?index=true
    • https://4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com/ugd/31bf02_448349da26a046f9a4dbd3ca47a60934.pdf?index=true
    • https://ef5e9b3f-1a8e-4c79-9b60-34b8f8133c96.filesusr.com/ugd/18574e_3f2087c16ff940938e9564f4c9975c17.pdf?index=true
    • https://f87ce62f-3d5d-4c42-bff3-2e7d00444551.filesusr.com/ugd/72ed28_b3287600d3a946739940913deb91d0c2.pdf?index=true
    • https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_ab152fcb132e449e8f834cfa7dbcd808.pdf?index=true
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_090f98b8d674412480b3ccc4c0a978a6.pdf?index=true
    • https://f55c6975-0091-4942-a106-dc80285e5f9d.filesusr.com/ugd/8a4248_3ad8c6f0c103404ea47d536e3f35a29d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d206.bin
cf4cc07b68a3ac594af9b7e37b824bc398eeca3c385979b7cf00e25f7a4e0084		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD206 5000 bytes
font_01_sfnt_off0000e306.bin
4730bed5aa36dcea5ec3cc795710e038a5c5dd7d032605033bdf8caf838574c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE306 10184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.