Malicious PDF — malware analysis report

Static analysis result for SHA-256 131190edc11fd41d…

MALICIOUS

PDF

73.8 KB Created: 2021-03-06 23:45:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 792c144ceebb5136b7421b9e1fc9b520 SHA-1: 1e73f040930ba56388052c1ca420dcf9a57fe3d9 SHA-256: 131190edc11fd41d324fd335efc8b7635b053fce2d0bf6f5e3ffd108b4bf3937
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains a lure related to NHS annual leave calculations. It embeds an external URI pointing to 'ponafet.ru', which is highly suspicious and likely leads to a phishing or malware distribution page. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=how+is+nhs+annual+leave+calculated
    • http://winoxolupuvil.getenjoyment.net/sakifopejamupov.pdf
    • https://cdn-cms.f-static.net/uploads/4527237/normal_603d7c0d5c165.pdf
    • https://cdn.sqhk.co/dofofigeniso/R1ALhgq/1448455907.pdf
    • https://static.s123-cdn-static.com/uploads/4425772/normal_60074d35a541a.pdf
    • http://rozogididibusar.sportsontheweb.net/nuzeduwusoxenowivowibiv.pdf
    • https://cdn.sqhk.co/nezusoxe/jghbHEj/app_screen_recorder_download.pdf
    • https://static.s123-cdn-static.com/uploads/4496216/normal_600654959195d.pdf
    • http://kikababono.mywebcommunity.org/50979953864.pdf
    • http://dosijefa.mypressonline.com/2016_buick_lacrosse_owners_manual.pdf
    • https://cdn.sqhk.co/jepipovi/igfiisB/download_ski_safari_2_mod_apk_versi_terbaru.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jamiwurono.epizy.com/what_are_management_skills_in_a_business.pdf
    • http://tasijojaludet.rf.gd/5124684423.pdf
    • https://uploads.strikinglycdn.com/files/a4df5f53-a28a-4b4b-960d-cd36d9e7efc8/lubipata.pdf
    • https://uploads.strikinglycdn.com/files/cf1fb90b-855c-4a6f-9b1e-8067c036bd70/black_and_decker_weed_eater_instruction_manual.pdf
    • http://tavoxelelenasi.onlinewebshop.net/37284391731.pdf
    • https://uploads.strikinglycdn.com/files/14dceabd-6da9-4dbd-a504-91adcf0c8e7b/how_to_install_a_hunter_ceiling_fan_without_remote.pdf
    • http://kiwozoma.epizy.com/wovim.pdf
    • https://uploads.strikinglycdn.com/files/fe4815da-6fb5-456a-904b-0a6a296631ed/what_are_some_inspirational_speech_topics.pdf
    • https://uploads.strikinglycdn.com/files/1875b33d-d656-4b34-99e0-f2bd56ecc714/zebulufezuk.pdf
    • https://uploads.strikinglycdn.com/files/da06cd51-7f45-48a2-9392-e08367f55a81/how_to_apply_two_stage_paint.pdf
    • https://uploads.strikinglycdn.com/files/2adc7cb1-4ac8-425d-a5a9-02eeea7e203b/natojumiroreluvu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e587.bin
4d33759ac33d5b30d2aa3557b8dd48b62fb917282858c4959c7f1c4bd939d575		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE587 5044 bytes
font_01_sfnt_off0000f6c5.bin
fb6d4be0ac7eec3d7d75e612d7ed0224862e6d9fcee32e4f88d683ebae33fa71		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6C5 10236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.