Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e70141258d90aca…

MALICIOUS

PDF

91.3 KB Created: 2021-04-03 21:04:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e8a1c7f2773e8761f0d6427ccb46774f SHA-1: 71dac38174b730f5c4cbba01877de19770c725d1 SHA-256: 8e70141258d90acaded390bac686a38afbfffe0d2493023a5183bf393bd3c9eb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL, https://ponafet.ru/wix?keyword=east+texas+cable+tv+guide, which is the primary indicator of malicious intent. The document body, though heavily obfuscated, suggests a lure related to 'East Texas Cable TV Guide', aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=east+texas+cable+tv+guide
    • https://wiwujakibites.weebly.com/uploads/1/3/0/7/130740442/bodunamimapovi-sumupu.pdf
    • https://sewajevujunu.weebly.com/uploads/1/3/2/8/132814136/fa7c7f2.pdf
    • https://cdn.sqhk.co/lakarejof/Z1idic7/87585255267.pdf
    • https://cdn.sqhk.co/jimavidozeze/8icSMH9/chess_pieces_values_points.pdf
    • https://cdn.sqhk.co/xezalagefog/dCrKcs3/amazon_alexa_app_for_android_5._1.pdf
    • https://lujoduxatodovaw.weebly.com/uploads/1/3/2/3/132302833/fuzowarapevodativ.pdf
    • http://lezigovedavide.getenjoyment.net/dakobixovoxalotigobimot.pdf
    • https://cdn.sqhk.co/mevazasid/ichaKgc/ninja_tobu_unlimited_money_apk.pdf
    • http://zotikarida.medianewsonline.com/hindu_religious_books_in_bangla_free_download.pdf
    • http://paruxezogu.mygamesonline.org/academic_writing_student_s_book.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/panalipolifod/letter_to_explain_late_submission_of_report.pdf
    • http://vukekabexipog.rf.gd/plague_inc_cheats_android_no_root.pdf
    • https://uploads.strikinglycdn.com/files/f1762477-e087-4a63-9139-21fc18aefa0e/how_to_search_images_on_google_by_size.pdf
    • http://girupesoja.rf.gd/99136709295.pdf
    • https://s3.amazonaws.com/kawotexulozax/osrs_fastest_1-_99_fletching_guide.pdf
    • http://pavafisufopu.myartsonline.com/advantages_and_disadvantages_of_parliamentary_system.pdf
    • https://s3.amazonaws.com/pubopelej/79393649491.pdf
    • http://ligozuwi.rf.gd/how_to_put_bobbin_case_back_in_singer_simple_sewing_machine.pdf
    • https://s3.amazonaws.com/lezopobigeza/how_to_travel_to_mount_fuji.pdf
    • http://nojupaven.rf.gd/epson_perfection_v370_photo_treiber_fr_mac.pdf
    • https://s3.amazonaws.com/kumasala/xixalirabi.pdf
    • http://wififeju.atwebpages.com/titration_of_oxalic_acid_with_naoh_lab_report.pdf
    • https://uploads.strikinglycdn.com/files/7bcd4926-eea2-4a58-8b6d-49d530307f66/45396237203.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011a81.bin
8c344c69e4bf7bb7f4fef6c0c858db8d7281f8453af58517df9828ab185c84c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A81 4904 bytes
font_01_sfnt_off00012b42.bin
3e7624876ebfcb8abfaef6a51b8bff71a207c5ddc46acce45eb24b870e90373c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B42 11508 bytes
font_02_sfnt_off000151e0.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x151E0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.