Malicious PDF — malware analysis report

Static analysis result for SHA-256 4743845e6570cda2…

MALICIOUS

PDF

72.0 KB Created: 2021-04-04 09:41:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50db82e8a6ceb829a109a258c706f67a SHA-1: ceb450e837d0f56b0a547695fa9036ac68732621 SHA-256: 4743845e6570cda2b270697a995e3ce9f99f838a8b7f56f52826dc1309258f78
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL pointing to 'ponafet.ru', which is likely the primary lure. The presence of PDF-specific heuristics and the general nature of the extracted content suggest an attempt to trick the user into navigating to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=bissell+proheat+2x+model+1383c
    • https://cdn-cms.f-static.net/uploads/4449984/normal_602c8db45c5b8.pdf
    • http://hyipinvest.site/31701852998fy21c.pdf
    • http://trycabinets.xyz/57623431571c2lyn.pdf
    • http://buxodubofazaki.iblogger.org/muvifofenan.pdf
    • https://cdn-cms.f-static.net/uploads/4470977/normal_605f343cb8500.pdf
    • http://airned.ru/934160950789wbqy.pdf
    • http://tameeniraq.com/vukeneliwuxuboxq61t7.pdf
    • http://sodaapp.pro/49980693189nte29.pdf
    • http://raisinsapp.club/sum_of_the_interior_angles_of_a_triangle_2_worksheet_answer_key46ovk.pdf
    • http://salleop.xyz/xuzufavax9l.pdf
    • http://ledimpress.biz/6_ps_of_marketing_by_philip_kotler46o4f.pdf
    • https://cdn-cms.f-static.net/uploads/4465930/normal_601f16f53205e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fipijife/logic_pro_x_for_dummies_2nd_edition.pdf
    • https://uploads.strikinglycdn.com/files/3768b70d-f27d-46f9-b470-0ce0261a81b1/o_praise_his_name_chords_key_of_g.pdf
    • https://uploads.strikinglycdn.com/files/12c2f94c-5c99-42fe-a889-a0c9ff8ca24f/tajidipe.pdf
    • https://s3.amazonaws.com/wezukep/badshah_hussain_noha_mp4.pdf
    • https://uploads.strikinglycdn.com/files/a92962dc-ae53-4cdf-9839-c00f24c0b42b/62124322251.pdf
    • https://uploads.strikinglycdn.com/files/843f6750-2077-4a15-aadb-d251ba553fca/43688044294.pdf
    • https://s3.amazonaws.com/zidenigad/factotum_90_achievement_guide.pdf
    • https://s3.amazonaws.com/rudelazifizuvo/academic_journal_paper_format.pdf
    • https://s3.amazonaws.com/numegubowalonan/louisville_basketball_injury_report.pdf
    • http://wofelekupobepo.epizy.com/hoist_the_colours_sheet_music.pdf
    • http://rirafobom.rf.gd/britain_for_learners_of_english_james_o_driscoll.pdf
    • http://nadilafirot.rf.gd/presonus_studiolive_16.4.2_price.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d94d.bin
4546e34edc1df0fb5dd2bac23f9283cc794f4f1085dd8f3edc1bc4ac570fd892		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD94D 5972 bytes
font_01_sfnt_off0000ed7b.bin
660a14501544c95a051d12c964ca5d4a8bde29390b2a72b686fe7357a3fc039e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED7B 10928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.