Malicious PDF — malware analysis report

Static analysis result for SHA-256 a28128e2a7355b6d…

MALICIOUS

PDF

72.6 KB Created: 2021-03-23 19:51:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1f0f398926bf4585d86c9ceb631cc01 SHA-1: d5125180b4ae2b0d50f87e660fcfa9d1518e5bba SHA-256: a28128e2a7355b6dc893d2edd2d2df39a7e0437f68c2f445faafe2248a767424
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'ponafet.ru', which is likely used to host a phishing page or a second-stage payload. The document body, though heavily obfuscated, contains keywords related to product sales, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=hibiscus+schizopetalus+for+sale+uk
    • http://argo-tourism.com/what_is_fives_name_in_the_umbrella_academy22opr.pdf
    • https://cdn-cms.f-static.net/uploads/4382614/normal_60273f6496d4c.pdf
    • https://static.s123-cdn-static.com/uploads/4460466/normal_5ff6756424c51.pdf
    • https://static.s123-cdn-static.com/uploads/4457572/normal_600084ab58890.pdf
    • https://cdn.sqhk.co/vavewiren/hPwk7tY/storm_of_wars_sacred_homeland_wiki.pdf
    • http://damita.fun/6641386958985iks.pdf
    • http://fofakowusagafo.22web.org/terapia_cognitivo_conductual_ansiedad_en_nios.pdf
    • http://tohld.in/what_is_the_storyline_behind_the_nutcracker_balletrvz5m.pdf
    • https://cdn.sqhk.co/girewobo/ieZ4ihj/super_n64_emulator_pro_apk.pdf
    • http://requiredjokblog.com/anarchy_online_agent_guide_2018a4g1k.pdf
    • https://static.s123-cdn-static.com/uploads/4379722/normal_5ff9b58f4530a.pdf
    • https://static.s123-cdn-static.com/uploads/4410414/normal_5fe0e6c055f3b.pdf
    • https://cdn.sqhk.co/xanuramalu/havvCgh/opera_balet_teatri_afisha_2019_dekabr.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sojikavufor.rf.gd/irregular_verbs_german_worksheet.pdf
    • http://tifuximixadove.rf.gd/70751684090.pdf
    • https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_b4d2a9dd7ee84bd9a8a6ade080d58f86.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bad9e424-37c2-4624-a18b-6bf46522e8cd/black_and_decker_cordless_hedge_trimmer_with_battery_and_charger.pdf
    • https://uploads.strikinglycdn.com/files/0c6bb2be-3a73-43ce-b0f6-d3c408b6d577/descargar_libro_el_reino_de_este_mundo.pdf
    • https://uploads.strikinglycdn.com/files/5e86898f-e608-4415-8b73-958c24b8a980/26122752061.pdf
    • http://nexopuvesoreben.epizy.com/the_vampire_diaries_book_series_amazon.pdf
    • https://uploads.strikinglycdn.com/files/53c48e61-fb40-46ed-9bca-9e2a4dfec88c/94363537619.pdf
    • https://ac4cd5cf-e861-4b1b-a585-e47049f737a6.filesusr.com/ugd/843280_3cff36db1ace442fae57ab825052879d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db70.bin
d07d7b72baec02a1c579a4109ab4efbad3444fbb59f62d090d94af4400595034		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB70 5316 bytes
font_01_sfnt_off0000ed85.bin
f53aaec54644e4d9fb80cb6b4e907bb11055232fbeafc0d84fd35a896d483ca4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED85 11448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.