Malicious PDF — malware analysis report

Static analysis result for SHA-256 55bf1ab5936bd6fa…

MALICIOUS

PDF

75.6 KB Created: 2021-03-15 10:47:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: efef0234d700f95ff5aac58a6f0ccaf1 SHA-1: 77bbfb2a490208a4b24631b940590d6abd7c8657 SHA-256: 55bf1ab5936bd6fa9a523a830d4503606dc838b9235c539aeaa1da3a65dff2af
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO abuse tactic. One of the primary external URIs points to a suspicious domain 'ponafet.ru' which is likely used to distribute further malicious content or phishing pages. The ClamAV detection and ML classifier also strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=gears+reloaded+apk+nvidia+shield
    • https://gotedajasokidu.weebly.com/uploads/1/3/1/4/131407980/7246783.pdf
    • https://mokabeninenaji.weebly.com/uploads/1/3/4/0/134013120/2532083.pdf
    • https://budojidotepaso.weebly.com/uploads/1/3/5/3/135312143/wasazomezapuwud_jitiditamitoz.pdf
    • https://biwawidojimu.weebly.com/uploads/1/3/4/6/134648839/65710123a2c0747.pdf
    • https://zipatusuf.weebly.com/uploads/1/3/4/0/134012633/1502110.pdf
    • https://pepisukuwen.weebly.com/uploads/1/3/1/6/131606293/babuki.pdf
    • https://junurewumopu.weebly.com/uploads/1/3/2/7/132740614/dapiwedo.pdf
    • https://ginuzakonufa.weebly.com/uploads/1/3/2/6/132681862/b8fe54858e810.pdf
    • https://tubuwixufadone.weebly.com/uploads/1/3/5/3/135315283/8836576.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_b6063b0c46c14e3ea24ba90d1efc7dab.pdf?index=true
    • https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_4859ea2dbf064b09972c1214fe608bee.pdf?index=true
    • https://s3.amazonaws.com/mokamoba/99445846051.pdf
    • https://s3.amazonaws.com/dusined/facilitator_guide_template_powerpoint.pdf
    • https://uploads.strikinglycdn.com/files/b256c1e0-ba9c-4528-b9ae-77f978d4dc96/35761658541.pdf
    • https://uploads.strikinglycdn.com/files/b001beca-d26d-4675-af07-9afb96559b84/12032255357.pdf
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_a627cee87f3e43ba9e286cfa767c0bae.pdf?index=true
    • https://uploads.strikinglycdn.com/files/29c2d2ff-9bfb-4466-8c16-a2515c28f2d9/beludeneremulixed.pdf
    • http://pikubub.onlinewebshop.net/zidefogagopanujum.pdf
    • http://soranodabiwegi.myartsonline.com/fender_super_champ_x2_head_vs_combo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e753.bin
9f170d7190d898104bc0d865e3bb33c7095a63231d01d5967cead5b63bc63d7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE753 5200 bytes
font_01_sfnt_off0000f904.bin
bdd90b00c0e23ca42a8202d73efec857383533083669958a316fb48713be8f4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF904 11684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.