Malicious PDF — malware analysis report

Static analysis result for SHA-256 b40124e57be5461f…

MALICIOUS

PDF

83.6 KB Created: 2021-04-08 09:31:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d78727453ec8e9ff8cc84aecbb9bd6b SHA-1: 849e8a771e490853ccc4313811bdc075879aa85a SHA-256: b40124e57be5461f317968e5e6985570fae504a7db986ea128779f0a7ddc4f0c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with heuristics indicating an advance-fee scam lure. The document body, though heavily obfuscated, contains references to 'westing game pdf download' and metadata indicating it was generated by wkhtmltopdf, suggesting it's a crafted lure. The presence of multiple external URIs, including the primary one `https://jumiwimov.ru/wix?keyword=westing+game+pdf+download`, strongly suggests this PDF is designed to redirect users to malicious sites for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=westing+game+pdf+download
    • http://rigoditibalun.mywebcommunity.org/computer_knowledge_for_bank_exams.pdf
    • http://vvinorama.website/how_do_you_reset_the_filter_light_on_a_broan_range_hood4olcb.pdf
    • http://tokio-2020.fun/88358715689xakea.pdf
    • https://sunawakajisume.weebly.com/uploads/1/3/4/3/134324988/vuxanu.pdf
    • http://instacopyrighthelpteam.com/how_to_setup_hp_eprint_enterprise_on_iphoneew8fl.pdf
    • http://auto-fishing-rods1.club/bcycle_houston_promo_codeaxpiz.pdf
    • http://bumumapa.mypressonline.com/523090206.pdf
    • https://megularebenava.weebly.com/uploads/1/3/1/1/131164421/sudegux.pdf
    • https://namosupegu.weebly.com/uploads/1/3/4/3/134313644/xawufesekite.pdf
    • http://idealslimitaly.site/one_of_us_is_lying_peacock_tv2qufv.pdf
    • https://cdn-cms.f-static.net/uploads/4452395/normal_600f2e3de5524.pdf
    • http://bodyita.space/nubuz2le3f.pdf
    • https://tulopesonu.weebly.com/uploads/1/3/5/3/135318186/fowimedoxaxed-loparotog-birigo-tiborajutux.pdf
    • https://cdn-cms.f-static.net/uploads/4406191/normal_6065de7dc18a9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1466dd98-11be-42e9-85dc-dcaabbf86e96/remains_of_the_day_summary_litcharts.pdf
    • http://farovosodiwes.atwebpages.com/cashew_nut_health_benefits.pdf
    • https://uploads.strikinglycdn.com/files/9d92d839-648d-4475-83bd-2b5684cd4e32/92709400846.pdf
    • https://uploads.strikinglycdn.com/files/f75e32dc-4195-4d69-a6ba-9b2a86750c77/simplehuman_rechargeable_soap_dispenser_blue_light.pdf
    • http://zajupulavofawi.myartsonline.com/computer_general_knowledge_quiz_questions_and_answers.pdf
    • https://uploads.strikinglycdn.com/files/8e8e7897-0572-489d-90c5-49137b2066f9/how_do_you_reheat_leftover_pasta.pdf
    • https://uploads.strikinglycdn.com/files/868689a1-4cfa-4ffa-bad7-926e4e9f8030/41764902432.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a76.bin
d4088ef56b09d9654e0180115c8dd9de6cabaad37fd3e34887d03ee80e27ef8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A76 5368 bytes
font_01_sfnt_off00011cca.bin
4e6756da89d21451c94921eb70076a4f0d7c3fe16659cbf70933332869db8aea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CCA 10740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.