Malicious PDF — malware analysis report

Static analysis result for SHA-256 53d8376b07c7bba0…

MALICIOUS

PDF

81.2 KB Created: 2021-03-16 02:06:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44129e4451943f7000e13e0ed7cd35f8 SHA-1: 6ed8e99c58d81ad7b0416299dd278f89b49e86b6 SHA-256: 53d8376b07c7bba0f2538ecc8ea1ccf410cf4ab3ba938526b2d3c66abd3e8485
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it uses urgency and password-protected archive lures, common in phishing. The embedded URL `https://ponafet.ru/wix?keyword=powerland+generator+customer+service` likely leads to a phishing or scam page designed to trick the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=powerland+generator+customer+service
    • https://static.s123-cdn-static.com/uploads/4448126/normal_5fff51660f8fe.pdf
    • http://nomenowunesazoz.scienceontheweb.net/journey_to_the_center_of_the_earth_full_movie_download_in_english.pdf
    • https://cdn-cms.f-static.net/uploads/4471710/normal_604e5d11b7c37.pdf
    • https://cdn-cms.f-static.net/uploads/4462980/normal_602774d2c2fbd.pdf
    • http://vanimerukaguto.scienceontheweb.net/neil_degrasse_tyson_quotes_the_universe_crossword.pdf
    • https://static.s123-cdn-static.com/uploads/4413111/normal_5ff98baf069fc.pdf
    • https://cdn.sqhk.co/dijadive/fFwOPEe/minecraft_horror_maps_2_players_gannicus96.pdf
    • https://cdn.sqhk.co/nuduniguwufo/shjJC2x/reporters_notebook_pogo.pdf
    • https://cdn.sqhk.co/kowipopi/jhiigjV/thyristor_switched_series_capacitor.pdf
    • https://cdn.sqhk.co/pozuwifofub/ggdijr7/jereburepuxi.pdf
    • http://zakewabo.scienceontheweb.net/the_rose_hive_method_challenging_conventional_beekeeping.pdf
    • https://static.s123-cdn-static.com/uploads/4377931/normal_5ffd3ec2a6124.pdf
    • http://copyrighthelpcentral.com/50820353144dkcmo.pdf
    • http://copyright-helps-team.com/how_to_add_a_hard_return_in_wordimr39.pdf
    • https://cdn.sqhk.co/melipetoluf/ifif1Ik/billie_eilish_10._5_fashion_doll_bad_guy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e86c6366-0652-46cb-9e1f-5633a133dba9.filesusr.com/ugd/510a18_b15b7140a7e943c8b9fd7e0fb4221939.pdf?index=true
    • http://kepofif.onlinewebshop.net/jusatusonokemufalubixewat.pdf
    • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_031ab263f4e74474a7cccb02722600bf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7c215e9a-4134-411f-a7f4-c3ac71f27cb8/is_blast_stronger_than_boros.pdf
    • https://uploads.strikinglycdn.com/files/aba9dda6-10b8-4113-b563-9390108773a8/luzobukejetobulazetidoruw.pdf
    • https://uploads.strikinglycdn.com/files/37898e05-bb65-4192-a260-7bd6a526960e/70742238841.pdf
    • https://uploads.strikinglycdn.com/files/b53c9b05-9e3a-4d65-bf0d-1d9d56646135/how_to_use_hoover_vacuum_attachments.pdf
    • https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_c814b09e916b43349273b8095ee6de31.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cf3e68b5-f7a2-4d8a-b2b4-35e753905cb6/traktor_s4_mk1_user_manual.pdf
    • https://73ea35ec-f0b0-4773-8bcb-d62b778c7de8.filesusr.com/ugd/a8e976_483a80d647a043e2bdf7e128a60348c0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe41.bin
1b7c5ea84de13e933a75f963811bd396c92fbe936bb549dd09d75c30b8de770f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE41 5412 bytes
font_01_sfnt_off000110af.bin
9560388706d37ac9bf798b28cfec2da3ac774f573883c0c5e0090516920dc977		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110AF 11300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.