Malicious PDF — malware analysis report

Static analysis result for SHA-256 150176ac3f3a0c8e…

MALICIOUS

PDF

78.5 KB Created: 2021-03-23 05:37:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 76c4193c3c4a4ee3d9957daf51683dce SHA-1: 2f44ca00b736da2f19b6490d4b91ca4830423d08 SHA-256: 150176ac3f3a0c8edad7654f46fd393cdeaf150c9a74f39ca0239a5e8e4c8ca6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL 'https://ponafet.ru/award?keyword=e+marketing+textbook+pdf' suggests a phishing or social engineering lure, aiming to trick users into downloading further malicious content. The presence of embedded URLs and the overall detection by security tools point towards a phishing attack, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=e+marketing+textbook+pdf
    • http://fejavodexata.getenjoyment.net/85820402880.pdf
    • http://zovitidagawas.sportsontheweb.net/alternating_current_class_12_formulas.pdf
    • https://cdn.sqhk.co/zozijawutuxu/ggYgPhc/patadepoji.pdf
    • http://wigalelo.22web.org/gikexovarewogevago.pdf
    • https://cdn.sqhk.co/nagotumubo/lYQw5j6/hp_blue_carpet_answers.pdf
    • https://cdn.sqhk.co/gapebeve/dpyjiEZ/slick_slime_sam_barbie_dress.pdf
    • https://cdn.sqhk.co/wezopexa/5G9xiez/cannonball_osrs_ge.pdf
    • http://wotukujis.sportsontheweb.net/14596190490.pdf
    • https://cdn.sqhk.co/zetuzire/ZjjKhii/tumblr_drawings_cute_alice_in_wonderland.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/34b424a6-0f41-478b-ac7f-25c2f789d21b/big_nate_in_a_class_by_himself.pdf
    • https://uploads.strikinglycdn.com/files/6075d84b-d658-4c7b-9e36-bd069a0ee0e9/does_tp_link_smart_plug_work_with_alexa.pdf
    • http://doganofikaraw.epizy.com/guia_de_antibioticos_2020.pdf
    • https://uploads.strikinglycdn.com/files/d96dd704-13f2-4d0d-b846-56477027484a/wjec_a_level_biology_past_papers_2018.pdf
    • https://uploads.strikinglycdn.com/files/058bbeaa-d6e1-4b8c-911b-cb60a3b48963/99403224763.pdf
    • https://uploads.strikinglycdn.com/files/ab583a9c-0b21-4461-a685-9e35abec3732/is_used_by_companies_that_produce_unique_services_and_products.pdf
    • http://siwojanapav.epizy.com/tedagabiwifo.pdf
    • http://padekapekalerel.rf.gd/bhartiya_kala_ka_itihas.pdf
    • http://pevipitoz.atwebpages.com/alla_prima_technique_oil_painting.pdf
    • https://uploads.strikinglycdn.com/files/51902f5a-0d8a-43cb-ba7b-64aaeffe3d80/xiaomi_home_security_camera_app_for_pc.pdf
    • http://vewawisu.onlinewebshop.net/67633760408.pdf
    • https://uploads.strikinglycdn.com/files/f46633bb-1970-48ca-ba01-95844cfe6978/kenmore_electric_stove_top_knobs.pdf
    • https://uploads.strikinglycdn.com/files/efa393ec-ec79-407f-b7e8-35824072a831/panelview_plus_7_compatibility.pdf
    • https://uploads.strikinglycdn.com/files/fb21dddf-6e33-44b7-bb00-a452711b66bc/greek_god_names_for_boy_cats.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3c3.bin
dacb103ef01ce75ca279a7157cc995ecc50664c3e6d1f6b2d3d25b6898167893		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3C3 5380 bytes
font_01_sfnt_off000105fe.bin
d389a07d3e9d71039ff247b069f1b72a780b54292f9e43af260609c78b0014bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105FE 11256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.