Malicious PDF — malware analysis report

Static analysis result for SHA-256 40fbe532b0b8d83a…

MALICIOUS

PDF

135.8 KB Created: 2021-03-19 08:40:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0be7e26b7ec3e5c9688d5a2908c1e8b6 SHA-1: 203e059565c46f2618c6cf9becaeed5e0f0687e7 SHA-256: 40fbe532b0b8d83ac2adb98a2ca9b7bc35e6136aa8af66ff3974bd74930c070e
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1190 Exploit Public-Facing Application T1059.007 JavaScript

The file is a malicious PDF identified by ClamAV and a machine learning classifier. It uses an advance-fee scam lure, masquerading as a weather report to deceive the user. The PDF contains an embedded external URI pointing to a suspicious domain, likely serving as a download or redirection point for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=weather+report+chigwell+essex
    • http://shoop-fm.ru/berkeley_review_mcat_download_freep01vo.pdf
    • https://static.s123-cdn-static.com/uploads/4392462/normal_5fca421c70394.pdf
    • http://mpvideo.org/21071290720bpdd2.pdf
    • http://nibelv.xyz/how_to_delay_court_proceedings4efpb.pdf
    • http://mozovurezet.iblogger.org/88885754589.pdf
    • https://cdn-cms.f-static.net/uploads/4420020/normal_5fd3bd44aa57a.pdf
    • https://static.s123-cdn-static.com/uploads/4370529/normal_5ffb39b8cb6ee.pdf
    • https://cdn-cms.f-static.net/uploads/4425229/normal_601502cae8ab9.pdf
    • http://merishwheelrecords.com/82312571936bd615.pdf
    • https://static.s123-cdn-static.com/uploads/4426425/normal_5fd02b65687aa.pdf
    • https://cdn-cms.f-static.net/uploads/4475739/normal_60274f3cecc5d.pdf
    • https://cdn-cms.f-static.net/uploads/4375070/normal_602ae55b10475.pdf
    • https://cdn-cms.f-static.net/uploads/4366623/normal_600d983975eb2.pdf
    • http://xoxuvajes.mywebcommunity.org/bubapumon.pdf
    • http://autokenn.com/business_information_technology_degrees5t7r.pdf
    • http://fovikoxesaweziz.medianewsonline.com/kenatu.pdf
    • http://bazunujovi.scienceontheweb.net/is_the_mortal_instruments_city_of_bones_on_hulu.pdf
    • http://jalazekesofijot.medianewsonline.com/kedaripolupewitadewoje.pdf
    • http://kagaromorin.medianewsonline.com/starcraft_2_units_counters.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://daroxexu.rf.gd/vimukifosogowedufetoxol.pdf
    • http://voturugivorajop.onlinewebshop.net/chlamydia_trachomatis_2020.pdf
    • http://zikoliduxa.atwebpages.com/bless_me_ultima_summary_chapter_2.pdf
    • http://xejobutek.onlinewebshop.net/92731240623.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d3fc.bin
e432f2ea143c14db907d85de25da58d5a2a90856cf9f705f8449a8d0212afeb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D3FC 5368 bytes
font_01_sfnt_off0001e65a.bin
f49ba0caa31f3316a658728ba6f136d3b464b3130b40fae3f951e36010323e96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E65A 13068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.