Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a44965f706395a7…

MALICIOUS

PDF

83.6 KB Created: 2021-03-28 06:40:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1422d29a91ad0b397b40fabd69a58f57 SHA-1: 1bc3e9cbd20eda5fa610ac345922d9ba0313c0c4 SHA-256: 3a44965f706395a740aa9aa6e4e482bb3809b93dd6258f18dc12ae2caab57a81
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to 'https://ponafet.ru/123?utm_term=bhakta+prahlada+all+songs', which is a strong indicator of a phishing or malware distribution attempt. The PDF structure and embedded content suggest it's designed to trick users into visiting this external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=bhakta+prahlada+all+songs
    • http://vizojuzoninunoz.scienceontheweb.net/digestive_system_anatomy_book.pdf
    • http://worabipupe.mypressonline.com/advanced_language_practice_download_free.pdf
    • https://cdn.sqhk.co/xubupigegi/cOigjhq/shellac_nails_done_at_home_without_acetone.pdf
    • https://cdn.sqhk.co/gufezitaxato/pihC0oA/real_football_2009_3d_java_game.pdf
    • http://nunesop.scienceontheweb.net/mulirezagano.pdf
    • http://tigafik.mygamesonline.org/english_speaking_eye_clinic_near_me.pdf
    • https://cdn.sqhk.co/mogizufofuj/eOgcog1/92362562684.pdf
    • https://cdn.sqhk.co/fegukajebaj/9hghblL/lenovo_thinkpad_t480_ports.pdf
    • http://tetutunugu.iblogger.org/cifs-_utils_rpm_for_rhel_6.pdf
    • http://luxomozuk.mypressonline.com/garbh_sanskar_book_in_hindi_by_balaji_tambe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xiwexuxe.atwebpages.com/bavenonuto.pdf
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_bab4131814354ea5ab57cda6c5e2826d.pdf?index=true
    • http://zotubune.myartsonline.com/bijilubolaseka.pdf
    • https://s3.amazonaws.com/woneketelak/juzunegaralaxi.pdf
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_8fd695caea1f4211acf41028f1fe457e.pdf?index=true
    • https://s3.amazonaws.com/dowavelaxam/xelog.pdf
    • https://0aa989e7-076c-475f-bc22-fff5ae310860.filesusr.com/ugd/b44be6_90ccda7e36f84beaa290f0abcfece86e.pdf?index=true
    • http://vedixemalirugi.atwebpages.com/kelekiwajexalowiv.pdf
    • https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_4ff878f6c1e7433e910ce3d85a1460fe.pdf?index=true
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_6b4039c917934b45bf2c881900dae9b1.pdf?index=true
    • https://s3.amazonaws.com/xeruxaxer/nicholas_sparks_new_book_the_return.pdf
    • http://menivafanar.epizy.com/2006_detroit_diesel_series_60_service_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ad0.bin
f8a473fed3a050ff20264bfcf9c1d37df859eeda62abcfe1c87236bdf611c72d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AD0 5332 bytes
font_01_sfnt_off00011ce9.bin
c0f242bc8806f2befc1951ad64180c835402a942104683e8b731f87b51b21bb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CE9 11004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.