Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2a359ef59366661…

MALICIOUS

PDF

67.6 KB Created: 2021-03-16 10:03:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 38dfbf440dd41fc20d3103c3c84beceb SHA-1: e3cc8ed0e3ca6fb882559eb34e641385ae972896 SHA-256: a2a359ef593666616001b018faee1f51c29080d01cbac234050f2cd5fcfc8acf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to 'ponafet.ru', which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to an 'Oriflame catalogue'. No scripts were extracted, but the presence of multiple unknown URLs indicates a potential for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9959

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=catalogue+oriflame+2020+pdf
    • http://wupofifaxixusi.66ghz.com/fadujexinuxunutopikelip.pdf
    • http://totaxusozavu.sportsontheweb.net/8731558608.pdf
    • http://busimaderule.mywebcommunity.org/72836184611.pdf
    • https://nurosizakudagag.weebly.com/uploads/1/3/4/6/134699554/vanofezesetosonetal.pdf
    • http://tosefabebiribow.scienceontheweb.net/nidafamotoxewunanipuwi.pdf
    • https://kurepisafigovu.weebly.com/uploads/1/3/1/3/131398088/a2081.pdf
    • https://sidilatadafexu.weebly.com/uploads/1/3/1/1/131164021/kugafim_dijirezojexaf_rofuva_bonixasevakuj.pdf
    • https://danifiwap.weebly.com/uploads/1/3/4/5/134585556/948707.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nuxulikiwab/remember_me_coco_sheet_music.pdf
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_2eca4731709b48838426e736b8f16f71.pdf?index=true
    • http://bogalibamadom.myartsonline.com/5_letter_words_that_start_with_n_and_end_with_g.pdf
    • https://7f993087-45f6-41f4-96e5-9dcaca18fb91.filesusr.com/ugd/9a92dd_1cd2c3256d034114a13ffc3acb3d0eb9.pdf?index=true
    • http://wumokobaleto.epizy.com/kidodubivafozefapikomi.pdf
    • https://uploads.strikinglycdn.com/files/ba818f97-d8b4-402c-9947-3f7829b9e617/saitek_x52_drivers_not_installing.pdf
    • http://faripemisale.rf.gd/zesijipomepupojekikumi.pdf
    • https://uploads.strikinglycdn.com/files/2422c68c-482d-4340-8021-d01f69811ef6/forejugitira.pdf
    • https://s3.amazonaws.com/wixatax/89717601961.pdf
    • https://979cd01f-16ea-4d2c-b189-234964c95597.filesusr.com/ugd/d4c4cf_ba455405c6a04e2e8d565151407906af.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8915c6e2-efea-48cc-afdb-41f81c8995d2/how_to_connect_hp_officejet_pro_8600_plus_to_mac.pdf
    • https://aaf8962b-2ea5-4403-bfea-7c32f2b3f77e.filesusr.com/ugd/8f3a65_b578cc7018b0422db2d9b989e8f463af.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1382937e-36cc-45ef-93d0-7cfa5a2275b2/51877762822.pdf
    • https://s3.amazonaws.com/kigavanus/18217305700.pdf
    • https://s3.amazonaws.com/pexodugosa/lands_end_school_uniforms_dress.pdf
    • http://jutatodimat.epizy.com/tuvujowuk.pdf
    • https://s3.amazonaws.com/vifusupegiza/sebawutafo.pdf
    • https://uploads.strikinglycdn.com/files/7a163846-1cf6-4f1a-bbfd-d1a0f38cee20/zozoletul.pdf
    • http://zasufogokalo.rf.gd/veluzaxonobatavomowuviwan.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdd5.bin
c3e1cb633591d26bc378889aa0361a5247df57d0de3cda1f14bb3d9251dea0f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDD5 5360 bytes
font_01_sfnt_off0000dff5.bin
6d4b60633ddc554b20c3395e276b6b3c0285e8a090f7cb92075e0b9209dcef9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFF5 9732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.