Malicious PDF — malware analysis report

Static analysis result for SHA-256 838552e5e742f63c…

MALICIOUS

PDF

80.1 KB Created: 2021-04-15 15:02:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7a2f63ad634700f96c246152994ab131 SHA-1: d60f1c03575252f4011f8e68d087119cdeedd415 SHA-256: 838552e5e742f63c748261e98b25be60270527d1407a04c3920fb1c0fd2d17bf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic firings suggest it functions as a link farm, embedding numerous external URLs, with a primary suspicious URL being https://ponafet.ru/strik. The document's structure and embedded links point towards a phishing or malware distribution attempt, likely using a spearphishing attachment vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=what+are+the+4+principles+of+taoism
    • https://cdn-cms.f-static.net/uploads/4485818/normal_6044d10f2853f.pdf
    • https://static.s123-cdn-static.com/uploads/4488339/normal_5feec3c3ba64b.pdf
    • https://cdn-cms.f-static.net/uploads/4486743/normal_604adc0b70273.pdf
    • https://xisasuwida.weebly.com/uploads/1/3/4/4/134472621/jonekibititewagaf.pdf
    • https://lidugozomamaxo.weebly.com/uploads/1/3/1/6/131606349/3427458.pdf
    • https://cdn.sqhk.co/gepabafi/0gjohgp/forge_idle_circuit.pdf
    • http://zoo-taxi.site/342424536002rhk5.pdf
    • http://mmamba.ru/endospore-_forming_bacteria_familyh2mlv.pdf
    • https://cdn.sqhk.co/rijolumexeb/Jpygc31/83469900426.pdf
    • https://cdn-cms.f-static.net/uploads/4476126/normal_606e407d44a8d.pdf
    • https://cdn.sqhk.co/baxijaxazixi/tMB9cij/government_tax_return_online.pdf
    • https://cdn.sqhk.co/koletexun/bidx8wM/pencil_cactus_for_sale_near_me.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_e087039bed9d44cb9d1509bbfbd77e3b.pdf?index=true
    • https://8ab8d0a6-ebcf-4503-ac90-3c5d9a0926ce.filesusr.com/ugd/8585d4_227385e4621a4377ab036614292fdbd8.pdf?index=true
    • https://8a7e94d2-1b07-4399-8a7b-cfebf1eb419e.filesusr.com/ugd/e78b77_c41c5187cd8843a7be701458cd6d8726.pdf?index=true
    • https://7fd92c66-d3af-485c-b7a9-31529ddfb1b5.filesusr.com/ugd/997d0f_ffce7c32cfc34807960627062c64edd6.pdf?index=true
    • https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_731cc4684c2644f78b1cfbbf2d1b43cc.pdf?index=true
    • https://359ea524-acbf-40a7-8d58-ee96a8f10bc8.filesusr.com/ugd/ca2e76_6d681fbab4704db6b7c44c5947b55716.pdf?index=true
    • https://6f81cef9-66a2-447d-9e1d-4c0427ef15c5.filesusr.com/ugd/4d935e_7445ea652c2148a9b65baabecdeeeb00.pdf?index=true
    • https://72858ab8-d36f-4bc2-b208-e5ec56e76d01.filesusr.com/ugd/3a4e0e_b4e239041c0c4970b9b3a7936c4f8897.pdf?index=true
    • https://d429d46a-6203-486b-8c9d-ede5597e1383.filesusr.com/ugd/419b00_6922f92f5eb84b4696b305521671e7ab.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f975.bin
f4c8192141404445127f46b99974c453de49809aed93745af240f52adf585448		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF975 5356 bytes
font_01_sfnt_off00010b95.bin
ff3d0c3aa858d1df200557916d48aacb8f68e22e7d0ba196fbea52588684a2a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B95 11252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.