Malicious PDF — malware analysis report

Static analysis result for SHA-256 40805947f08e711e…

MALICIOUS

PDF

109.9 KB Created: 2021-05-31 13:20:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: a3178ade52a0fd0792df598192cdf040 SHA-1: 95786a2a43d4fb9ca2681f585d990c3a5a11fb6b SHA-256: 40805947f08e711e3b978fa938a26ef4a372aaa1cc71dc8e61e3cbf0852841a2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URL `https://fokemale.ru/123?utm_term=amreli+steels+ltd+annual+report+2016` is likely the primary lure, disguised as an annual report.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=amreli+steels+ltd+annual+report+2016 PDF link annotation
    • https://kajuzenutojaso.weebly.com/uploads/1/3/4/6/134631714/8a0233.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375341/normal_605d6c8e2f7b1.pdfIn PDF document text
    • https://witowufagefalob.weebly.com/uploads/1/3/0/7/130738848/a1f846aa8e.pdfIn PDF document text
    • https://nenovalo.weebly.com/uploads/1/3/2/7/132712003/4806705.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417306/normal_601b1ceec86aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372376/normal_6046b25be712c.pdfIn PDF document text
    • https://tijesefufejeje.weebly.com/uploads/1/3/4/8/134858706/jaxalamekuwig.pdfIn PDF document text
    • https://xesanojazal.weebly.com/uploads/1/3/0/9/130968931/gusikanidogak.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447916/normal_60491d619cea5.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c37be85-df35-4561-8c5d-01b14768d83e/44880094318.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88e59106-8af4-4ef2-a28b-e8ea04ca65a9/jugelebogunixevuza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/985f04e8-f80c-416d-b449-98458b3852bc/what_is_self_determination_theory.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90362b6e-eaac-498d-b757-0f293c4786fa/28306902125.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a139fea-9f87-484a-8e52-ad602900ba24/soundcraft_ui16_multitrack_recording_update.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19bcc64a-f999-4113-b2db-0c99c708869b/tefarojobe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5e9f258-f836-40b4-8d6c-2fc4f7c5c2e4/41604588414.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e48ca32-6331-42a6-9656-e094dc0d6311/blank_printable_periodic_table.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d279014d-0013-4182-9760-336c4e14a7b3/11921103068.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/383a9143-4413-421e-ae46-208dee0c6d4b/13856769019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dded2c8d-3ba0-4403-93ba-6680e1aa707b/interior_design_colleges_in_india_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/416bfc1f-501b-4c5c-9536-5ac43e638bb4/running_with_the_firm_book_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e38f9348-4964-4c76-8880-e6bfca0f8ae8/zinetozarajofalawed.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013f1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F1C 6588 bytes
SHA-256: 005382e2065b0da57e787f2f773507d0c160eee35811b4fc35f33daab4160d2b
font_01_sfnt_off00014f6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14F6D 1768 bytes
SHA-256: d698744f837609a0c479a5c9552ce734b7e7a4b968974a977ed2ff9dfe46e2b1
font_02_sfnt_off000157da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x157DA 5572 bytes
SHA-256: 7f29f38cc5c27d1126a98af6eca86c90b7f1f5b91f67024a17f90cb9b985e389
font_03_sfnt_off00016ab3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16AB3 12120 bytes
SHA-256: 6eb870ca20fb5c70edd6191743f34713cf05a94f657b2b90a0abeaa33b80667a
font_04_sfnt_off0001936f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1936F 16136 bytes
SHA-256: 4a82d930af4ff3021f3d19cbd37464c8e664c90bef13661c9db69df894853898

Open this report in the interactive analyzer, or submit your own file for analysis.