Malicious PDF — malware analysis report

Static analysis result for SHA-256 b02a1fbdbd0517b3…

MALICIOUS

PDF

81.8 KB Created: 2021-03-28 07:26:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ed09a8ec1ade83faee1f36c3e70f2206 SHA-1: 4803b32b6f898dfe09b2a4419e997a6ff0b74fca SHA-256: b02a1fbdbd0517b356c0eaaaa99dbfd612e3a7f26f0182dd009f70979e3c0e05
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, particularly the one pointing to 'ponafet.ru', suggests a phishing or credential harvesting attempt disguised as academic content. No scripts were extracted, but the PDF structure itself contains malicious indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=binomial+distribution+lecture+notes+pdf
    • http://excellent-spb.ru/94159028963wpk8p.pdf
    • https://cdn.sqhk.co/pixukinoma/iihg1EF/lurin.pdf
    • http://dom-bita.org/24126615974r3jk6.pdf
    • https://cdn.sqhk.co/wusirilunoko/duidLhc/11354550797.pdf
    • http://uggi-ugg.com/memento_mori_jonathan_nolan_espaol74clx.pdf
    • http://dibiwunineso.iblogger.org/72369448563.pdf
    • https://cdn.sqhk.co/fapetemiji/hG0Kx4k/80_s_dance_remix_songs.pdf
    • http://pressit.space/rewigefaler9j3p4.pdf
    • https://cdn.sqhk.co/zewumabigige/Sggicjh/uhc_super_9_airsoft_sniper_rifle.pdf
    • http://tehnopolis.org/20234666743xu3rq.pdf
    • https://cdn.sqhk.co/lexelinowe/jitiiCH/blueberry_goat_cheese_ice_cream_recipe.pdf
    • https://cdn.sqhk.co/niwonosorude/hddDpYD/paragopagubupujewis.pdf
    • https://cdn.sqhk.co/jujejorule/djgbwjx/video_tv_sideview_remote.pdf
    • http://formulamoney.top/55127607374o4vza.pdf
    • http://businesshelpservice.com/7487574597414sg2.pdf
    • https://cdn.sqhk.co/lelogivotosu/dVvcjjf/cruise_from_galveston_tx_to_spain.pdf
    • http://zesamoa.online/32274569545q1fj8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://ruzawibo.rf.gd/ace_questionnaire_spanish.pdf
    • http://taranupuzoxel.rf.gd/pengertian_anamnesis_menurut_para_ahli.pdf
    • https://uploads.strikinglycdn.com/files/3e929278-71e6-4e72-a2ca-ce5358e16e88/is_there_a_lake_in_austin_texas.pdf
    • https://uploads.strikinglycdn.com/files/2de9e68b-759b-4bda-8a3b-782c211f6e84/kakuwodav.pdf
    • https://uploads.strikinglycdn.com/files/8dc547a2-7aad-44a2-a67e-cc1eb4f6916a/hexa_block_puzzle.pdf
    • https://uploads.strikinglycdn.com/files/b51d6e76-59a9-4ab2-989d-158b0f986343/fixiluwajowageboj.pdf
    • https://uploads.strikinglycdn.com/files/f1d3c889-77d1-4021-aa71-7737f7eef464/can_you_work_at_ross_at_14.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc21.bin
75cc71f9dd0083d3253ed0c85209af2942114fe582b1fe34ff2fb579bb5c9376		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC21 5372 bytes
font_01_sfnt_off0000ee38.bin
b2c0689854ac0ea1e50824e3d380a47f2307bde2134559f5a6c02117e4b1064d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE38 11604 bytes
font_02_sfnt_off000115e2.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115E2 16204 bytes
font_03_sfnt_off00012b0f.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B0F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.