Malicious PDF — malware analysis report

Static analysis result for SHA-256 63c3b9ec65a9fb0f…

MALICIOUS

PDF

77.6 KB Created: 2021-03-16 16:00:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 74455afba9e3cd0c6c12da81b468f655 SHA-1: eb0718f6b8d1da0899894695e50b05a03214e254 SHA-256: 63c3b9ec65a9fb0fc0c7dd5624ca6a953121bf447862d86eb28912c4a38368df
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://ponafet.ru/award?keyword=definition+of+community+participation+pdf', which is likely part of a phishing or malware distribution scheme. The document body is heavily obfuscated, preventing a clear understanding of its specific content, but the presence of the malicious URL strongly suggests a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9557

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=definition+of+community+participation+pdf PDF link annotation
    • http://semengergel.ru/627620736301w0b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449000/normal_601b622360841.pdfIn PDF document text
    • http://silkhfig.bid/cub_cadet_lawn_mower_parts_near_melmhc1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473062/normal_5ff206985cadc.pdfIn PDF document text
    • http://regifugujuvu.iblogger.org/ahmadiyya_nazam.pdfIn PDF document text
    • http://callup.today/credit_card_statement_examplea185l.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ce6b271-202c-4b9e-affb-c0bf5af33711/kelojopok.pdfIn PDF document text
    • https://s3.amazonaws.com/figidireki/vuvutaba.pdfIn PDF document text
    • https://s3.amazonaws.com/xipavir/carrom_game_pc.pdfIn PDF document text
    • https://s3.amazonaws.com/tibanepoxilibud/st_augustine_fl_weather_report.pdfIn PDF document text
    • https://s3.amazonaws.com/feborobegibew/22804360754.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e73f02d1-f440-4def-8312-71a693f100b7/40514054504.pdfIn PDF document text
    • http://wasomozonomevam.rf.gd/wumumuvibiriwedakipes.pdfIn PDF document text
    • https://s3.amazonaws.com/tufujifinobiro/acoustic_research_ar-_m200_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a27d971-8824-4237-8368-9ecd9d5fec17/pezikabemofudup.pdfIn PDF document text
    • http://rovifulonumon.rf.gd/craftsman_v60_chainsaw_chain_replacement.pdfIn PDF document text
    • https://s3.amazonaws.com/somisilegex/rumunoligop.pdfIn PDF document text
    • https://s3.amazonaws.com/lovomijelun/wonezefubebalewikopub.pdfIn PDF document text
    • https://s3.amazonaws.com/fizaxo/solubility_worksheet_ap_chemistry.pdfIn PDF document text
    • http://rosukijabadizi.epizy.com/fleur_de_lis_piano_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/resixexi/united_airlines_information_technology_jobs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a676341d-f385-4389-9d30-e909c5f1d443/vudimev.pdfIn PDF document text
    • https://s3.amazonaws.com/kefiperizonofu/gegobogolilifosox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2c18256-a35d-4db8-85b6-d125a9ebe50d/what_is_1000_of_100.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbf5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBF5 5192 bytes
SHA-256: 533e5b8f4af179cbd49341865343622e6ad9b0501ba2ffc7daa5106d5a2d6c0b
font_01_sfnt_off00010d9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D9E 11860 bytes
SHA-256: 64aec59c1711eb12195caa527d1d784ce19868a4cfe8fe916f05c53e14229d9c

Open this report in the interactive analyzer, or submit your own file for analysis.