Malicious PDF — malware analysis report

Static analysis result for SHA-256 f41b540135590d2b…

MALICIOUS

PDF

77.2 KB Created: 2021-03-23 20:02:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 3fb28eaa01fefd51fed1476ebf80dce9 SHA-1: 18799d8d4585960c9424fdd2e2efe8c6a241736a SHA-256: f41b540135590d2bf89a322ae00c4e041f6e1de667cf0ab289466c0ba63e5759
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, and exhibits characteristics of a PDF link farm. It contains numerous external URIs, with the primary suspicious URL being https://jumiwimov.ru/award?keyword=omega+6+fatty+acids+pdf. The PDF structure and heuristic firings suggest it is intended to redirect users to malicious content, likely as part of a phishing campaign or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=omega+6+fatty+acids+pdf PDF link annotation
    • https://zorajifedimak.weebly.com/uploads/1/3/1/4/131437130/c3d695e99.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386849/normal_5fe7937d9facb.pdfIn PDF document text
    • https://wabezapodila.weebly.com/uploads/1/3/1/4/131437306/42cf6e1b6.pdfIn PDF document text
    • http://kadaxejob.mypressonline.com/godovezebugepaxuganuxipi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481825/normal_5fe2884e4a902.pdfIn PDF document text
    • https://bemesamug.weebly.com/uploads/1/3/4/7/134722017/6183799.pdfIn PDF document text
    • https://wixezijuni.weebly.com/uploads/1/3/5/3/135312108/21292.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/datarofapakil/reset_clicker_garage_door_keypad_without_code.pdfIn PDF document text
    • https://s3.amazonaws.com/tejuvonixag/3d_model_free_for_unity.pdfIn PDF document text
    • http://bogalibamadom.myartsonline.com/38426535486.pdfIn PDF document text
    • http://gogegoxo.epizy.com/ashab_bedir_duas.pdfIn PDF document text
    • http://wakurenup.epizy.com/gexexefimorolizuvibo.pdfIn PDF document text
    • http://jimagonekitop.epizy.com/pozesajobikasonebuv.pdfIn PDF document text
    • https://s3.amazonaws.com/sakaburepagase/construction_safety_glasses.pdfIn PDF document text
    • https://s3.amazonaws.com/zarevizebi/basic_english_850_words.pdfIn PDF document text
    • https://s3.amazonaws.com/wemazun/furorakuvesaseratelijat.pdfIn PDF document text
    • http://zubiluwetij.myartsonline.com/najaged.pdfIn PDF document text
    • http://gojudupawoziwex.epizy.com/sony_str-dh740_firmware_update.pdfIn PDF document text
    • http://pabotojixupi.atwebpages.com/minn_kota_riptide_terrova_112_ip_link_bt_36v-112lb-87.pdfIn PDF document text
    • https://s3.amazonaws.com/zabejuvijolu/excel_vba_cell_value_equals_sheet_name.pdfIn PDF document text
    • https://s3.amazonaws.com/pokorevalaxex/jirujoravu.pdfIn PDF document text
    • http://pevogikuxupeja.onlinewebshop.net/how_to_change_batteries_on_simple_comfort_thermostat.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF36 5632 bytes
SHA-256: 19eed8a1f739717482339b6f6cddf9554f9cbde51e52111862156058560d1b85
font_01_sfnt_off00010261.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10261 10728 bytes
SHA-256: 4dd1ebd5826ae54b4f97cb1d3cab6355a6094c4aad2c6c8b91816e3c3d9d04ce

Open this report in the interactive analyzer, or submit your own file for analysis.