Malicious PDF — malware analysis report

Static analysis result for SHA-256 97b556120374766c…

MALICIOUS

PDF

78.7 KB Created: 2021-03-22 02:59:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 25f30bdfef65cf130a880f420e0e6709 SHA-1: d84058fe2934c91c1c63c9a212a6d6b177c01c93 SHA-256: 97b556120374766c8dcc92bce2db67667f2687e84f321205c40c6a726f44de38
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, 'ponafet.ru', which is likely part of a phishing or malware distribution scheme. The document's content, though heavily obfuscated, suggests a lure related to a 'tenant recommendation letter'. No scripts were extracted, but the presence of embedded URLs and the overall malicious classification strongly indicate a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=tenant+recommendation+letter+pdf
    • http://tradebot.space/vocabulary_for_ielts_writing_task_1_and_2i065j.pdf
    • http://ritual-venki.online/what_to_eat_when_trying_lose_weight0xuq8.pdf
    • http://uscreditreport.info/zamonanovow5w4o.pdf
    • https://cdn.sqhk.co/vedukosamo/hhNhjgj/steven_universe_quiz_what_gem_are_you.pdf
    • http://dashcamtopbest.com/21876949305nkvio.pdf
    • http://andyhongdigital.com/blaze_and_the_monster_machines_episodes_streamings52po.pdf
    • http://chaptejvxz.fun/rexodinifunejazemdh2w4.pdf
    • http://italylife.pro/best_snes_emulator_for_pc_2019ytq14.pdf
    • http://ayazshabutdinov.club/vudusemedagabafulawigugu2p1zv.pdf
    • https://cdn.sqhk.co/wuxaguzifep/hOijBMC/dark_knight_dummo_lyrics.pdf
    • http://jexurumefatomig.22web.org/zibipakafemegev.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d2149389-94f3-4352-a8c2-a83d1989a02f/napadidiberedulabat.pdf
    • https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_97124634583a40ca8e67ae7b155fe809.pdf?index=true
    • http://vuzujalaj.epizy.com/23088556793.pdf
    • https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_7225534f141e435cb8950643e6ced6d0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/21784161-d1cf-4264-8481-728e06380f46/how_to_fix_a_treadmill_belt_that_wont_move.pdf
    • https://uploads.strikinglycdn.com/files/8ba67b51-d238-40ee-926b-21081935a03a/kedovonefaxafuvosixudej.pdf
    • https://uploads.strikinglycdn.com/files/de070d7b-bfb9-49ef-ba29-9e800096b400/69529101063.pdf
    • https://4123e755-5e7e-4fb8-b167-49ba90d37259.filesusr.com/ugd/fd3290_dd9d298d96e341378054785fcd343d04.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4e514ea3-041b-4a81-97fb-ffbbacf2b370/cowon_plenue_d2_best_price.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5d8.bin
68ffa9446f5e7c0d28fcc1ca605649301074132a2e65ed9b84625a6346123575		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5D8 5072 bytes
font_01_sfnt_off00010705.bin
85fe752f8b956aa75df9bb12347cf336ce34db1f55807890060af8a09cbdc244		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10705 11476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.