Malicious PDF — malware analysis report

Static analysis result for SHA-256 0da345e33667c93c…

MALICIOUS

PDF

84.2 KB Created: 2021-03-16 18:14:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ee5e2a95ca6af5c7a5c96cdb2c91b3c SHA-1: dc617d6ae33e41f5f2015f17cf2f6fd45098460a SHA-256: 0da345e33667c93c23cdb602081f02cb1bae81b95c28b9819ab6cbf1b1aeb695
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. The presence of an embedded URI pointing to 'ponafet.ru' and other suspicious URLs suggests a phishing or malware distribution attempt. The heuristic 'SE_URGENCY_LURE' further supports the phishing pretext by indicating the document contains urgency or deadline language.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=nice+guidelines+hypertension+pregnancy+2019
    • http://in-arenas.com/nordictrack_c2200_belt_replacementqmbmh.pdf
    • http://openchambre.xyz/zerazugezixez0jdf.pdf
    • http://raraveluwogevuw.mypressonline.com/step_growth_and_chain_growth_polymerization.pdf
    • https://dakuwiremab.weebly.com/uploads/1/3/4/9/134901294/b93635baaf66a.pdf
    • https://cdn.sqhk.co/fepexeguma/hrfTja1/pocket_little_pony_18.pdf
    • http://zoraniguza.22web.org/60698667215.pdf
    • http://gixitetopes.scienceontheweb.net/objectives_of_online_banking_system.pdf
    • https://cdn.sqhk.co/wodaximewule/ghb37hc/tank_smith._io_unblocked.pdf
    • https://cdn.sqhk.co/figegixo/XifQhiX/woody_blocks_game.pdf
    • https://reratedazakowim.weebly.com/uploads/1/3/1/3/131378897/begewalepo.pdf
    • http://sifulodidikit.22web.org/raabta_piano_notes_sheet.pdf
    • http://instapriz365.site/three_plans_for_reconstruction_apushotb14.pdf
    • https://detatabuloto.weebly.com/uploads/1/3/5/3/135346227/wawenuvakosugip.pdf
    • https://tezefidusipenu.weebly.com/uploads/1/3/1/8/131857758/4c4e4ac35c9.pdf
    • http://kartaidatodemeleri.com/does_the_darkest_minds_have_a_sequel4sofe.pdf
    • https://cdn.sqhk.co/bufomofa/gfnmhhe/picsart_photo_studio_old_app_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://dovesibikore.epizy.com/44866424225.pdf
    • http://zefexivatovuk.epizy.com/nakafavu.pdf
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_4829db2ec4474a4f9bb8173c7e08b3b7.pdf?index=true
    • http://vekejuf.atwebpages.com/does_walmart_sell_wii_consoles.pdf
    • https://a39ac558-8fe8-437d-9e10-dc9402d6cb9c.filesusr.com/ugd/1ebe14_c0978f0d906b472a990371c3b22db90d.pdf?index=true
    • https://0778d94d-b67d-49c3-8f6f-43f52d6edec9.filesusr.com/ugd/b85eb0_1a9af0d68df44519bbb97dca24104053.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc1b.bin
0a94bcb0f49bd152f341fd51040070bb7d39183402c2b33acab8503b3447f1f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC1B 5768 bytes
font_01_sfnt_off00010fb6.bin
521bf3ec016dde12c9ebc146387afcdf73a1244334b78ec752e19c02d710dd61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FB6 11004 bytes
font_02_sfnt_off00013520.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13520 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.