Malicious PDF — malware analysis report

Static analysis result for SHA-256 40ffa564f0049d03…

MALICIOUS

PDF

77.0 KB Created: 2021-03-17 12:46:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: be15a41d1137ace06d95b888eedb756f SHA-1: d248a59ef9893d0850d96b560a53b04f9eec59ea SHA-256: 40ffa564f0049d03ecd03c0076bd8c1cc21a6ee208ad08bf1d4dd77900a467c3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading a malicious payload. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URI suggest a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=employment+rate+in+nigeria+pdf PDF link annotation
    • http://kuzojud.66ghz.com/bojamoxutomiw.pdfIn PDF document text
    • http://zaxunux.iblogger.org/nouve_biotin_mantecorp_bula.pdfIn PDF document text
    • http://zofunubesosena.mypressonline.com/85591627204.pdfIn PDF document text
    • http://fosipuzo.mypressonline.com/12639156280.pdfIn PDF document text
    • http://tufuwavaziga.mygamesonline.org/why_does_my_nighthawk_carbon_monoxide_detector_beeping.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nonidimujosapa.epizy.com/prayers_to_prevent_death.pdfIn PDF document text
    • https://s3.amazonaws.com/lefemijip/32200099878.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/673c55d1-e344-4fbc-96db-2f19d7f87205/what_does_adrenaline_1_in_10000_mean.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f979f72f-afc0-4c8b-b7d0-21fe525ec74d/stairway_to_heaven_kdrama_where_to_watch.pdfIn PDF document text
    • https://s3.amazonaws.com/gagotaniwipure/pe_error_in_lg_washing_machine_front_load.pdfIn PDF document text
    • https://354df738-7a8c-4643-bdcd-aa58f7c4bd0c.filesusr.com/ugd/69cf62_40285a447f0443dba42c48f23f59aec1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xijalovelokolep/6819768027.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05561c8f-a018-473f-ad27-9d8d48a9d4d7/sizobopijavegajek.pdfIn PDF document text
    • https://s3.amazonaws.com/wulagisi/ruzodejukubovomavawuxano.pdfIn PDF document text
    • http://rowezezivifa.epizy.com/karuduvevofusevafinadop.pdfIn PDF document text
    • http://muvekalufisu.atwebpages.com/rademu.pdfIn PDF document text
    • https://s3.amazonaws.com/zalomi/pifexexodegivaxubatiduv.pdfIn PDF document text
    • https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_2db42c3737714863867c8de06308e624.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/208e10bb-d34e-41a6-8840-3ca2613be406/eureka_airspeed_exact_pet_filters.pdfIn PDF document text
    • https://4de1274e-a26b-4e71-a0d1-d86f0cfee7ee.filesusr.com/ugd/ee4d88_935f0c2129814dd4bdca90378ff15064.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sitok/57881453547.pdfIn PDF document text
    • https://fab88ded-2f12-46c9-b6ec-f290036286cc.filesusr.com/ugd/cce69c_b82fcbd524554afd9d52472402a832da.pdf?index=trueIn PDF document text
    • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_352e02e9ce574382937f908d300a31d8.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebfb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBFB 5240 bytes
SHA-256: a889c7b435cddc17502a08b32e5b961088cf9e14a6ce3b2be1461b31a66dc548
font_01_sfnt_off0000fdc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDC7 12948 bytes
SHA-256: 10d77dc2bf93f1229ae71d1407689184a843832b65e1033f0275c6408bdc9f37

Open this report in the interactive analyzer, or submit your own file for analysis.