Malicious PDF — malware analysis report

Static analysis result for SHA-256 912cb474b0b2d2ea…

MALICIOUS

PDF

73.6 KB Created: 2021-04-07 18:11:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3519ec95ba4bd37da98d9a08eea425e4 SHA-1: d6b4904a2f0eea4a81317506dc4a85c85890e684 SHA-256: 912cb474b0b2d2eab2a05bf6a5eb21ae560373a9a6c0aed7e5c3a8fbedb51994
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious content. It contains an embedded URL pointing to 'https://ponafet.ru/123?utm_term=battery+percentage+pro', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to 'battery percentage pro'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=battery+percentage+pro
    • https://cdn-cms.f-static.net/uploads/4369495/normal_602b3eefcf5aa.pdf
    • https://cdn.sqhk.co/dugelabomaw/gddYO5T/gimme_shelter_movie_free_download.pdf
    • https://cdn.sqhk.co/podizapexiv/icFkidv/somomefututovejagewe.pdf
    • https://cdn-cms.f-static.net/uploads/4402933/normal_6027aee58de26.pdf
    • https://cdn.sqhk.co/xeliwiwogivo/2jdvLto/natusimosazuwotevul.pdf
    • https://cdn-cms.f-static.net/uploads/4376875/normal_5fd9a9c40aa2c.pdf
    • https://cdn-cms.f-static.net/uploads/4485162/normal_605704b453462.pdf
    • https://cdn-cms.f-static.net/uploads/4451374/normal_6045e87257719.pdf
    • https://cdn.sqhk.co/zamokaxu/iiSz0Ad/titan_quest_ps4_couch_co_op_patch.pdf
    • https://cdn-cms.f-static.net/uploads/4446937/normal_605bb1bd91eb4.pdf
    • https://static.s123-cdn-static.com/uploads/4366959/normal_5fc9b2afe6406.pdf
    • https://cdn.sqhk.co/mekibekowufe/hjahh71/bikozusex.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zebarufuridorur/white_deluxe_zig_zag_sewing_machine_manual.pdf
    • https://s3.amazonaws.com/fodose/how_to_get_rid_of_big_pimples_fast_at_home.pdf
    • https://uploads.strikinglycdn.com/files/9c70b4ba-f719-401a-b17e-afcf1454ec5e/how_to_make_a_peasant_dress.pdf
    • https://uploads.strikinglycdn.com/files/7f9fcf79-a0f4-44fe-9174-7b4b181d8684/nesejifilofofiketiga.pdf
    • https://uploads.strikinglycdn.com/files/f3e2ba9e-f2e4-44a7-972b-b1753fd480c5/40921473916.pdf
    • https://s3.amazonaws.com/nawosineromigi/is_nauli_kriya_dangerous.pdf
    • https://uploads.strikinglycdn.com/files/0be7d1b7-4740-4e1f-a688-4c7ddf49e39e/aroma_10_cup_rice_cooker_walmart.pdf
    • https://s3.amazonaws.com/jebokizez/soundcloud_apk_free_for_android.pdf
    • https://s3.amazonaws.com/wizuluworafid/gezajif.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2f8.bin
7fa5b94a3f6c72ab2e6cc4d03ceb52ea04566303d17f36f1bf4e8c9e51884472		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2F8 5044 bytes
font_01_sfnt_off0000f43e.bin
2015d47084ea61d344caa016fd119f4bb734e15a5a440cb07111365b99347e36		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF43E 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.