Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e8feadf899afd72…

MALICIOUS

PDF

121.9 KB Created: 2021-03-19 17:30:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54b1c07ca127d4312097112cd54332e2 SHA-1: b1eb54bdb0dbb80892e233d2b28900e919022901 SHA-256: 7e8feadf899afd7239eacaea4d93dd00ddb6eb5ee45f6a9aa7e4872a7493e97a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics and a ML classifier, with ClamAV detecting it as a 'Pdf.Phishing.Trojan'. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or redirection mechanism. The embedded URL 'https://ponafet.ru/wix?keyword=alpha+kappa+alpha+founders+day+images' and the link farm URL 'http://wivevadevenumet.mywebcommunity.org/memabik.pdf' are key indicators of malicious intent, likely serving as lures for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=alpha+kappa+alpha+founders+day+images
    • http://wivevadevenumet.mywebcommunity.org/memabik.pdf
    • http://fukerijinexin.mygamesonline.org/30875819173.pdf
    • https://cdn.sqhk.co/sobexofap/1xjjE1P/64948576405.pdf
    • https://cdn.sqhk.co/kubepugemaki/SA0jg5G/plain_city_ohio_county_auditor.pdf
    • https://cdn.sqhk.co/gasajolop/gcWGVhL/strikers_1945_mod_apk_unlimited.pdf
    • http://papotanepif.22web.org/memogeforogawenazadez.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://dc273c12-e125-4738-b2e6-b96bc4bd5eb7.filesusr.com/ugd/c8df25_3952802f727a40b28ed989124c678195.pdf?index=true
    • http://fufabufitilaf.epizy.com/kaboxotuzovowu.pdf
    • http://kosezofejesuxef.atwebpages.com/dunkin_donuts_wake_up_wrap_recipe.pdf
    • https://s3.amazonaws.com/nitatotol/72799320633.pdf
    • https://s3.amazonaws.com/zijivevip/7602687843.pdf
    • https://s3.amazonaws.com/bajapovogam/basic_accounting_golden_rules.pdf
    • http://juzozofejiku.rf.gd/poxerulijotanoxuduvege.pdf
    • https://s3.amazonaws.com/safago/basic_spanish_grammar_download.pdf
    • https://s3.amazonaws.com/fasomusogapovi/list_of_christian_martyrs_in_the_20th_century.pdf
    • https://s3.amazonaws.com/kufazete/tovumiwuwisarosu.pdf
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_9482eae30b2e4ad481cc367e450d567a.pdf?index=true
    • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_d7c1ad3836e846c4ac1314fe55e0e1a9.pdf?index=true
    • https://s3.amazonaws.com/vovopafubipu/80046651661.pdf
    • https://s3.amazonaws.com/zemunomipazikez/47341703647.pdf
    • https://86b7bb9a-6a0b-496c-a062-e8aa60c365d0.filesusr.com/ugd/dcf311_2ff1ed7b757f4a1dbc384a5bd1286e11.pdf?index=true
    • https://bf6af823-cb0d-4ee8-9d5b-4f0b1de5ed24.filesusr.com/ugd/9eb187_d55a9d2a419a47fca3ab3de2d1b51ac1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019c4e.bin
99bb45406df5a7aea0fb902b191c22f6b5cce172f4daf9e96bd05a7a79233dbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19C4E 5612 bytes
font_01_sfnt_off0001af4e.bin
397881f2b92adbdf796b340b6bc7650e3d01d32cde090a3a4d719fb3f8928a76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF4E 12628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.