Malicious PDF — malware analysis report

Static analysis result for SHA-256 4379445d96a98f04…

MALICIOUS

PDF

85.4 KB Created: 2021-04-07 23:57:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 940fde96b6801b0093aa32c8fb9984c5 SHA-1: 23d991c74e9c38b39fca0e99b8139450995ff09c SHA-256: 4379445d96a98f0455de07c7501f4083397f51026339dcf782cb11bc543b5c2a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. The document body, though partially corrupted, suggests a lure related to 'how to use a backstrap loom'. The presence of multiple unknown reputation URLs, including one directly linked to the document's apparent topic, indicates a high likelihood of phishing or malware distribution. ClamAV detection further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=how+to+use+a+backstrap+loom
    • https://xododasewa.weebly.com/uploads/1/3/4/6/134600374/63153cc489.pdf
    • http://instahelpforbusiness.com/904971420586hhta.pdf
    • http://fasad-dom.site/master_cleanse_book_by_stanley_burroughspi9md.pdf
    • http://ita-fitness.fun/what_is_relapse_prevention_trainingx293w.pdf
    • https://julasunanuk.weebly.com/uploads/1/3/4/3/134308365/88012.pdf
    • http://doordash.link/1752868126426uc.pdf
    • http://apparently-home.com/83270054545njkpo.pdf
    • https://dopitusorotid.weebly.com/uploads/1/3/0/7/130738794/menebuz_kawerilon_kexelanesowejav_gorefaluf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/784fee4e-494d-44da-9e51-9a74f07a16f4/what_time_is_the_bethlehem_star_visible_tonight.pdf
    • https://s3.amazonaws.com/jafujasiwetid/94008699266.pdf
    • https://s3.amazonaws.com/pibajuwi/excel_vba_do_loop_array.pdf
    • https://s3.amazonaws.com/warapagefasovi/65763335410.pdf
    • https://uploads.strikinglycdn.com/files/f6d67ccf-1d48-478f-90f6-0b466e2ecc38/what_does_media_studies_mean.pdf
    • https://uploads.strikinglycdn.com/files/55186559-cf1c-4d9d-809c-bb014ae01ded/when_does_the_new_wu_tang_season_come_out.pdf
    • https://s3.amazonaws.com/vovopafubipu/tokiv.pdf
    • https://e6c529cc-411f-4195-b5ea-7b5fd081490a.filesusr.com/ugd/b7ab08_2d4688340aca4384bc3a6821139a872c.pdf?index=true
    • https://0879403c-3be5-48e4-925f-21334a7d5cfe.filesusr.com/ugd/407fcc_d7cda5543fba4af893e8709932797121.pdf?index=true
    • https://s3.amazonaws.com/wokesabisevo/what_are_the_four_core_elements_of_hip_hop.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/how_to_create_a_stock_watch_list.pdf
    • https://s3.amazonaws.com/gekojulog/54966199196.pdf
    • https://uploads.strikinglycdn.com/files/87514413-622a-4c06-beb4-b47478cc5709/95750966848.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010135.bin
da475618cd27f551c2eaef8e3ceb2b8d73672a56ef552e41c5416b6fadefb003		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10135 5064 bytes
font_01_sfnt_off0001127c.bin
8fa25026bb73b013ec895dedd9afb582aaf898d8b1ac0411cda94c09fad37768		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1127C 11188 bytes
font_02_sfnt_off0001386f.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1386F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.