Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b8f2b5ce40e9e80…

MALICIOUS

PDF

85.3 KB Created: 2021-03-15 03:04:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f522f120fccc6b3b57fb9f7991e0a0e4 SHA-1: 30ba8e49d37f9a5f9e785a0c450b189f4d8b60c0 SHA-256: 4b8f2b5ce40e9e80f84b16178e29b561f536a1c7ced5fe4d3885a5b70e34a027
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous external URIs, with one pointing to 'ponafet.ru', suggesting it's part of a phishing or malware distribution campaign. The presence of embedded URLs and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further support this, indicating the document is designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=discounted+cash+flow+method+example+pdf
    • https://cdn-cms.f-static.net/uploads/4402964/normal_604e89d7162db.pdf
    • https://cdn-cms.f-static.net/uploads/4386361/normal_604cec27b8e3c.pdf
    • http://zonerokemub.getenjoyment.net/libro_de_historia_universal_contemporanea_1_bachillerato.pdf
    • https://cdn-cms.f-static.net/uploads/4460071/normal_601a887680152.pdf
    • https://static.s123-cdn-static.com/uploads/4413007/normal_5ff8653c27083.pdf
    • http://tetiviguxawik.getenjoyment.net/ahe_dayamaya_biswa_bihari.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_c205747c8d6f41a0a5e0b0dd317ed697.pdf?index=true
    • https://s3.amazonaws.com/jajuzasalikirut/chevrolet_captiva_2008_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/2e82da73-fd4b-43e0-8223-15741de08d68/lakshmi_narayana_stotram_in_telugu_lyrics.pdf
    • https://d33b8dfc-9792-4d26-9d81-613d0bd32a71.filesusr.com/ugd/d34367_602d2d46914242d5ad24385f2d4c0053.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8dce3cf1-4868-45d1-8bd0-4a843602c1b8/the_right_way_to_tie_a_robe.pdf
    • https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_fde8130170714481a85cd6b86d0a1c59.pdf?index=true
    • http://kazigolukujo.epizy.com/java_tutorial_free.pdf
    • https://uploads.strikinglycdn.com/files/5f990d53-56e1-41d7-983c-3ba9b19dd9e9/kamilokigikamuxowegur.pdf
    • https://s3.amazonaws.com/sasufufa/hisense_40_inch_tv_wall_bracket.pdf
    • http://bijolijufapida.rf.gd/garapule.pdf
    • https://s3.amazonaws.com/rabewiruzitewa/96145883910.pdf
    • https://s3.amazonaws.com/tezofuretejom/45741028092.pdf
    • https://s3.amazonaws.com/laginekux/jefixubesevakojugiga.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d8b.bin
6a6a3688fb2bb6e9f652aad1c32cd3c88b075100d458965f95e42d263d29230d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D8B 5456 bytes
font_01_sfnt_off0001201c.bin
553b57922c21e5e94cff0e8ca54bdb55f4d80ca6dca0abdcf615e66f07f10bf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1201C 11272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.