Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f41f6c9193b3c4b…

MALICIOUS

PDF

80.6 KB Created: 2021-05-17 06:50:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: d273bd7c204357a97cc4df8908fea208 SHA-1: dadfe11b8283e31369f207803e3ae46b794da3b7 SHA-256: 6f41f6c9193b3c4b73113d835dabd7457e288e86f6f4afc19881dbfdc1742ad1
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking documents, but one external URI points to 'ponafet.ru/strik'. The ML classifier flagged this PDF as malicious with high confidence. The document body, though heavily obfuscated, contains references to 'public speaking ideas for students' and 'wkhtmltopdf', suggesting a lure to disguise malicious intent. The presence of numerous external links, including one to a potentially malicious domain, indicates an attempt to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=public+speaking+ideas+for+students PDF link annotation
    • https://sefositudixe.weebly.com/uploads/1/3/4/5/134524400/sikuvotiturenem-jutosiwi-rotexokumel-mureketapi.pdfIn PDF document text
    • https://rulovukefaz.weebly.com/uploads/1/3/4/7/134712077/eb5dd11ab3.pdfIn PDF document text
    • https://jipagulus.weebly.com/uploads/1/3/1/3/131379543/tumelajar.pdfIn PDF document text
    • https://cdn.sqhk.co/xixujipum/rhdCPif/school_of_dragons_free_dragon_quests.pdfIn PDF document text
    • https://lodokevez.weebly.com/uploads/1/3/4/4/134476034/gamazubosez_nokonuveb_walezawudojit_sevewa.pdfIn PDF document text
    • https://cdn.sqhk.co/sivofedexim/jihdjii/car_simulator_2_hack_apk_mod_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/farefasejikap/marginal_and_absorption_costing_techniques.pdfIn PDF document text
    • https://s3.amazonaws.com/nagudo/the_distance_between_us_chapter_13_summary.pdfIn PDF document text
    • https://1c92f6d8-19eb-429c-9239-1cf6be91372f.filesusr.com/ugd/cc1a03_ea1bbd0aea37455bb73fed5c9cb5a7c0.pdf?index=trueIn PDF document text
    • https://a694a867-b0fa-45cd-b082-7f9abf80b1a7.filesusr.com/ugd/430cb2_a9d99cd9dc8a4082b4f5e742b6690f34.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/veledabejufi/derefozep.pdfIn PDF document text
    • https://s3.amazonaws.com/pegek/33706195524.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/portfolio_lighting_parts_replacement_glass.pdfIn PDF document text
    • https://s3.amazonaws.com/vapite/cakewalk_by_bandlab_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/nitajosasa/dapos.pdfIn PDF document text
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_75d3985e665c494396c33c920b387342.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fizup/21547896078.pdfIn PDF document text
    • https://989eff4c-946f-4221-9817-1a8d60f2082d.filesusr.com/ugd/7edf14_48617b01417342298ab3381901d915a2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xalexojaxipud/linksys_ac1200_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/xoguwavosuje/pediatric_lipid_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/nitajosasa/rexizugevibutarumap.pdfIn PDF document text
    • https://s3.amazonaws.com/tiluwisulepam/what_was_ivan_ilyichs_occupation.pdfIn PDF document text
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_1c71d9cf4bca4791a3c2074920017868.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fce9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCE9 5528 bytes
SHA-256: c101cba2e3a89d05e47fa95ebbc4a394faed294443edd3cc277b70980d4d9040
font_01_sfnt_off00010fc1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FC1 10784 bytes
SHA-256: 13c0f0bb8c70c2d00e325114e5ffafbd9ebe37269f52ee288022a15ba883a571

Open this report in the interactive analyzer, or submit your own file for analysis.