Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ee40cbb600ea27d…

MALICIOUS

PDF

89.3 KB Created: 2021-03-18 19:11:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 506d8cacf9d9483a48ba99560cdcedb8 SHA-1: d14aa3ecb25d595323129e780f72bbb1539d93ab SHA-256: 6ee40cbb600ea27dbf385945175d428e067df31145c2617d710bf454747b91cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically pointing to 'https://ponafet.ru/award?keyword=international+auditing+standards+issued+by+ifac+pdf'. This URL is presented in a context that suggests a phishing or social engineering attempt, masquerading as a document about auditing standards. The ML classifier and ClamAV detection strongly indicate maliciousness, likely related to phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=international+auditing+standards+issued+by+ifac+pdf
    • https://cdn-cms.f-static.net/uploads/4366008/normal_6037d8aa55ae4.pdf
    • https://cdn.sqhk.co/mojesoje/X5Ihdjb/tigaruxenemibi.pdf
    • http://nijaxubazaziw.mypressonline.com/4721908339.pdf
    • https://cdn-cms.f-static.net/uploads/4499995/normal_601f90cbe9c85.pdf
    • https://cdn-cms.f-static.net/uploads/4446270/normal_60109274554a8.pdf
    • https://cdn.sqhk.co/zamodozitip/jjGEvii/57960423685.pdf
    • https://cdn-cms.f-static.net/uploads/4415769/normal_6017c4ed3f4f0.pdf
    • https://cdn.sqhk.co/zisuxemop/LBsXjhD/kimegugiluwixavesod.pdf
    • https://cdn.sqhk.co/waganozusi/E2RAhgE/17274148884.pdf
    • http://gimatadokij.mygamesonline.org/sh_script_while_loop_example.pdf
    • http://jekefidaz.mygamesonline.org/what_are_the_methods_and_techniques_of_teaching.pdf
    • https://cdn-cms.f-static.net/uploads/4497370/normal_604773f3559bb.pdf
    • https://cdn.sqhk.co/jipuxoxukul/gY1hgic/53914795753.pdf
    • http://debuged.mywebcommunity.org/wibixibezu.pdf
    • http://saniwigudovo.scienceontheweb.net/47302668180.pdf
    • https://cdn.sqhk.co/zifuvifiweva/angxdKe/president_race_2020_odds.pdf
    • https://cdn.sqhk.co/tusujoxaseru/HeggDhd/hidden_objects_printable_easy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zirutabu.myartsonline.com/suvuraromejovosunuxelebof.pdf
    • http://sipanokule.onlinewebshop.net/47676830041.pdf
    • https://s3.amazonaws.com/woberiz/photoshop_7_tutorials_photo_effects.pdf
    • http://revudipepofaten.myartsonline.com/material_requirement_planning_case_study.pdf
    • https://s3.amazonaws.com/potamotaz/landing_page_html_css_template_free.pdf
    • http://disoluje.myartsonline.com/best_social_skills_books_for_preschoolers.pdf
    • http://suwuriru.onlinewebshop.net/snake_oil_game_cards.pdf
    • https://s3.amazonaws.com/gonima/91894167058.pdf
    • https://s3.amazonaws.com/xirixepo/how_do_i_study_for_navy_advancement_exam.pdf
    • https://s3.amazonaws.com/kozibowisenatu/sijunota.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011dda.bin
f3a5588fb73e964caa21c979afa5cf220a1de978eb59f1a909a5e1e78c63c238		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DDA 5500 bytes
font_01_sfnt_off000130a6.bin
de5c2de48cf34d617fa4815d02488b95eddf411ee7635a4523e9981141e9da73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130A6 11360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.