Malicious PDF — malware analysis report

Static analysis result for SHA-256 37e0e0f1c091b7dd…

MALICIOUS

PDF

92.9 KB Created: 2021-04-08 05:17:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 66fe1848e6d0de60a1a0fb85cde73560 SHA-1: dd4805edefaa5311684538cc2dd344d60e395207 SHA-256: 37e0e0f1c091b7dd5d3ad61e60c8463b4d3acd605ae5fea00dfc490d9e1f459e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and a machine learning classifier assigned a high probability of maliciousness. The document contains an embedded URI pointing to 'https://ponafet.ru/123?utm_term=booklet+template+twinkl', which is likely a phishing or malware distribution site. The presence of PDF-specific heuristics and the overall detection score indicate a malicious intent, likely phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=booklet+template+twinkl
    • https://cdn.sqhk.co/genonitag/ggiejdO/forest_survival_mod_apk_android_1.pdf
    • https://cdn-cms.f-static.net/uploads/4366375/normal_603174b1438d0.pdf
    • https://cdn.sqhk.co/pedajobu/fidKpgd/my_t_mobile_app_download.pdf
    • https://cdn.sqhk.co/nawamuzimosu/5izhjgW/59433061373.pdf
    • http://dadibexibanewil.iblogger.org/instalacin_de_gas_domiciliario_la_paz_bolivia.pdf
    • https://cdn.sqhk.co/tiwasusul/bgduWku/83211659209.pdf
    • https://cdn.sqhk.co/xaduwudixum/jfWhbUW/sanico_incineration_godfather_2.pdf
    • https://cdn.sqhk.co/kuxixixixi/eijlWPj/archaeological_sources_of_delhi_sultanate.pdf
    • https://cdn-cms.f-static.net/uploads/4376611/normal_60191ee9c2592.pdf
    • https://cdn.sqhk.co/vimewiki/eWe4ijY/dragon_ball_opening_latino.pdf
    • https://cdn.sqhk.co/mewivupa/Njf8hib/freegames._org_bubble_shooter_3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kibulirol.rf.gd/formacion_de_boca_contra_quito.pdf
    • http://merekum.rf.gd/shl_inductive_reasoning_test_answers.pdf
    • https://s3.amazonaws.com/bokexizometun/corporate_annual_report_contents.pdf
    • https://s3.amazonaws.com/libusamagowuvo/fosiz.pdf
    • https://s3.amazonaws.com/kosipefojaw/hmrc_self_certification.pdf
    • https://s3.amazonaws.com/dowavelaxam/85839742234.pdf
    • https://s3.amazonaws.com/serogajugomiji/sulinegukaferugosa.pdf
    • https://s3.amazonaws.com/vesubodufisi/gugowa.pdf
    • https://s3.amazonaws.com/juzinaramip/how_many_calories_in_chick_fil_a_market_salad_with_dressing.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011239.bin
cc346d0f87e5a163d8bad94fd1370017abc21d59a11acf24cbfb8241b87fb13c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11239 4896 bytes
font_01_sfnt_off000122e7.bin
c35d4b0edc89386c838cf3d62850aae0cf6ea2c58b038d3c63766fd30d33738b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122E7 11916 bytes
font_02_sfnt_off00014b52.bin
66a3e9e802f491c3b198ee54dc8b3691958c5f464463dcee9f3c255bf375988c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B52 17808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.