Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e44549eb67e64eb…

MALICIOUS

PDF

197.4 KB Created: 2021-05-27 21:30:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 03fbabd7037f297af7c97ca9132ffc84 SHA-1: e1e893753305cd64f7e87a7a6afd7ca41bf59e44 SHA-256: 2e44549eb67e64eb35ca0fb53e62c03c3436c8a285b8b8c342e2beb8fc85c307
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with heuristics indicating it's an advance-fee scam lure. The document contains an embedded URI pointing to 'https://ponafet.ru/strik?utm_term=how+to+rap+on+a+fast+beat', which is likely the malicious payload delivery mechanism. No scripts were extracted, but the PDF structure and heuristics strongly suggest a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=how+to+rap+on+a+fast+beat
    • https://mosazipabefo.weebly.com/uploads/1/3/4/7/134735261/pidenituboke.pdf
    • https://kiwiwutirove.weebly.com/uploads/1/3/4/7/134707888/kewemovubob.pdf
    • https://baxojozejaxofo.weebly.com/uploads/1/3/4/5/134586757/50571.pdf
    • https://static.s123-cdn-static.com/uploads/4381543/normal_5fff3148ebc21.pdf
    • https://cdn-cms.f-static.net/uploads/4452853/normal_6013ac182f6e9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a20f4194-c64a-486f-9b07-f01c90287a66/42249536149.pdf
    • https://uploads.strikinglycdn.com/files/602b883e-506b-45d2-963b-88e45e2dfce7/25885003374.pdf
    • https://uploads.strikinglycdn.com/files/3fe83f8c-52a4-4ea0-ac3a-3abb645ec2a0/placing_equivalent_fractions_on_a_number_line_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/a57d1f55-3595-4466-bde2-5053ed7fbd4d/cyberpower_cp1500avrlcd_specs.pdf
    • https://uploads.strikinglycdn.com/files/c82312d1-71d8-41d0-8712-533134d7d1ed/what_is_the_phone_number_for_medicaid_in_wi.pdf
    • https://uploads.strikinglycdn.com/files/427f9e43-6925-4cc7-8468-b73968b63069/kulopejoleveloba.pdf
    • https://uploads.strikinglycdn.com/files/34b176ad-637b-4aed-9425-12b1c5b8a378/what_is_the_best_memory_card_for_canon_powershot.pdf
    • https://uploads.strikinglycdn.com/files/065679bd-62a4-41e7-8855-00904a0db2b9/conjugacion_de_verbos_regulares_e_irregulares_en_espaol.pdf
    • https://uploads.strikinglycdn.com/files/0ca7e788-a2fb-4e2e-b8e3-9de06a9c5999/kowezutati.pdf
    • https://uploads.strikinglycdn.com/files/f991f824-9b44-430b-be36-74717c736c89/install_fios_g3100_router.pdf
    • https://uploads.strikinglycdn.com/files/1934ccc2-f44f-4306-ae41-07813c2909c6/ruger_sr22_upgrades.pdf
    • https://uploads.strikinglycdn.com/files/91285f76-17c9-4964-8e8f-b1483cdd99e2/27057409933.pdf
    • https://uploads.strikinglycdn.com/files/f53ab7a2-4bd0-4b0f-9188-c827d0100417/pevasawomo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002c9a5.bin
b0d256ad26a7c718bc2d4db78607a1e274b20c53e788e5dcf5d5f775f0a8b67e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C9A5 5056 bytes
font_01_sfnt_off0002daf0.bin
2c72498fa52f689fa288627b6a49d3eb7bd183d5b1a2a3f25b3eeb428be29871		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DAF0 13708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.