Malicious PDF — malware analysis report

Static analysis result for SHA-256 b785bfb6b9188564…

MALICIOUS

PDF

74.3 KB Created: 2021-03-28 14:27:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9365a7867e2711d19b9ccc58da77335c SHA-1: 8ed9bb80d2acd108aeade4e203b91d80a69a7776 SHA-256: b785bfb6b91885648d855d5d8a30ce2693ee6aef67eec853cc2d031824e84edc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an external URI pointing to 'https://ponafet.ru/123?utm_term=uniforme+del+atletico+san+luis+2019', which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, contains text related to 'Uniforme del atletico san luis 2019', suggesting a lure to attract users interested in sports. No scripts were extracted, but the presence of external URLs and the overall detection profile strongly suggest a phishing or malware distribution attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=uniforme+del+atletico+san+luis+2019
    • http://menbp.online/compare_and_contrast_the_stakeholder_and_shareholder_models_of_corporate_governance0jdys.pdf
    • https://cdn-cms.f-static.net/uploads/4452862/normal_60253ee49c23f.pdf
    • http://dronextactical.xyz/first_united_methodist_church_troy_ncntezc.pdf
    • https://cdn-cms.f-static.net/uploads/4374373/normal_60603b0ecff01.pdf
    • https://cdn.sqhk.co/pelopuxi/ieiaTHk/wolf_wallpaper_hd_desktop.pdf
    • https://cdn.sqhk.co/gotulurowav/jeZp6ih/acura_tl_2012_manual.pdf
    • https://cdn.sqhk.co/ketegobuto/gXjixzX/make_photo_slideshow_with_music_free.pdf
    • https://cdn-cms.f-static.net/uploads/4444885/normal_604d2904ac790.pdf
    • https://cdn.sqhk.co/perolurowona/yFhawij/gun_shot_mp3.pdf
    • https://cdn-cms.f-static.net/uploads/4476947/normal_603e287f2fbe3.pdf
    • https://cdn.sqhk.co/ketejeti/aSkbjcl/stellaris_armchair_commander.pdf
    • http://atomyimperial.ru/mito_griego_medusa_historia8v4i6.pdf
    • https://cdn.sqhk.co/niririga/U2zjesv/nuditevat.pdf
    • http://reduslimitalia.website/list_of_feeling_words_for_adults15ikb.pdf
    • https://cdn.sqhk.co/fogobewataja/hjcigjc/7744232936.pdf
    • https://cdn.sqhk.co/saseponirifa/iggg8p9/67432679361.pdf
    • https://cdn.sqhk.co/narulaloro/gDicXjj/mubawopefonobami.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jupoti/18716533664.pdf
    • https://uploads.strikinglycdn.com/files/01b8c600-4dd0-45af-a269-74adf33dd54d/17883132276.pdf
    • https://s3.amazonaws.com/nagev/82932545817.pdf
    • https://s3.amazonaws.com/rabewiruzitewa/college_website_templates_html5.pdf
    • https://uploads.strikinglycdn.com/files/3d4647b1-a3c5-40d2-9005-4fb850518655/a_dolls_house_henrik_ibsen_full_movie.pdf
    • https://s3.amazonaws.com/xoferuzu/landform_worksheets_for_2nd_grade.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfe9.bin
ad2e1595058c7986cba17b016d842f1a4ad0d403d59da19c7d0b8c9f1c6135ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFE9 5640 bytes
font_01_sfnt_off0000f303.bin
3f966e52dbe1174d9120117803d539b03b0c35f674cc18aeee760d8b3dd32830		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF303 11940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.