Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a3293e794028de1…

MALICIOUS

PDF

76.3 KB Created: 2021-04-17 15:40:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 466b9e5b1e71e30b5ed4dfa6c9b44098 SHA-1: 72cb6ddb2459f63cd094352c9d08e85971a2c8e1 SHA-256: 0a3293e794028de132f6ebdbf4aefceb99691412120eb748d5011066deae01b4
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URIs, including one pointing to 'ponafet.ru', suggesting it's part of a link farm designed to redirect users to potentially harmful content. The presence of embedded URLs and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9786

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=sharp+portable+air+conditioner+cv-p10nc
    • https://cdn-cms.f-static.net/uploads/4378605/normal_6011da84931ca.pdf
    • http://itfamily.pro/beginners_sewing_tips0yifc.pdf
    • https://cdn.sqhk.co/bepifopid/z1Xdjjc/earthquake_today_los_angeles_twitter.pdf
    • https://cdn.sqhk.co/kidatufo/icujjKT/71713035744.pdf
    • https://cdn.sqhk.co/noloxunipe/cQiaice/bukaterazurufum.pdf
    • http://alcexpress1.xyz/la_perla_size_chart7cnil.pdf
    • https://cdn-cms.f-static.net/uploads/4403959/normal_6040409410263.pdf
    • https://cdn.sqhk.co/xoxamomajil/jcgcFY1/beach_buggy_racing.pdf
    • http://rudikonutabo.22web.org/a_song_of_fire_and_ice_board_game_review.pdf
    • https://static.s123-cdn-static.com/uploads/4420454/normal_5fcdce95e1da1.pdf
    • http://fekabonan.22web.org/what_is_traditional_songs.pdf
    • https://cdn.sqhk.co/feripamapuv/6W2lRgb/tip_top_shoes_review.pdf
    • http://pawarelubasiwu.iblogger.org/java_programming_tutorial_videos.pdf
    • http://ttop-shop.com/how_to_assess_for_bipolar_depressionhwtt9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://a22cca75-cc8f-459c-9eea-628147015b55.filesusr.com/ugd/2f8a36_d8eb1f68257b4ef092f2d42eb257ea94.pdf?index=true
    • http://nusorilafezevi.rf.gd/91525789440.pdf
    • https://b3d988c2-7a7d-4c3c-9141-221b6550481e.filesusr.com/ugd/9dda13_e805935b157442a9a77fac7e0a4182f0.pdf?index=true
    • http://junedujivoxoz.epizy.com/arrival_subtitles_free.pdf
    • https://46c0acaa-de7d-4f46-84f0-c2cf1d8ff7d9.filesusr.com/ugd/ac1638_8cb59200b73c4bbf8bab09fbe03696ca.pdf?index=true
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_15b5cd2287fa441ab03e5673f107a833.pdf?index=true
    • http://jolivuk.rf.gd/20003359353.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eadd.bin
7e444372d01b92c09847e931f63030b2f60d969b79df766560b731f37e791d04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEADD 5300 bytes
font_01_sfnt_off0000fcd7.bin
051e0ed928a88b943e8ba6063a77c6d61348b282b9e5764ea62101a5b8731d8b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCD7 10848 bytes
font_02_sfnt_off00012210.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12210 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.