Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2cac7c94ed93b29…

MALICIOUS

PDF

85.6 KB Created: 2021-03-21 09:25:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc53120579b72e2c8ccae0755b202498 SHA-1: 74ac68340406eafa6b0526f44b99463cfaf6efe1 SHA-256: c2cac7c94ed93b29c65cec3fe193ba353d3443349ccb90669e3f94a378ce3ffc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://ponafet.ru/123?utm_term=watch+image+boy', suggesting it's used to redirect users to a potentially harmful site. The presence of embedded URLs and the ML classification strongly suggest this file is part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=watch+image+boy
    • https://nidabiweni.weebly.com/uploads/1/3/4/8/134865500/8fc49f35.pdf
    • http://tajizomekoza.iblogger.org/projects_using_arduino_uno_board.pdf
    • https://cdn.sqhk.co/jivazufevi/ghehggW/xowiw.pdf
    • https://cdn.sqhk.co/waxolulum/fC9y1VD/25258013046.pdf
    • http://fajujefa.getenjoyment.net/19757247992.pdf
    • https://matiposokatogu.weebly.com/uploads/1/3/0/7/130739068/peluroredufatip.pdf
    • https://cdn.sqhk.co/wanaxowuwot/oigwuhj/51194003675.pdf
    • https://komibaxes.weebly.com/uploads/1/3/1/6/131606619/tukifa-popedafurugevaw.pdf
    • https://cdn.sqhk.co/dedejosewor/iaDqnhw/1512439065.pdf
    • http://sebekeruxa.iblogger.org/antigone_free_download.pdf
    • http://valuburikodajad.medianewsonline.com/19764006804.pdf
    • http://givimemaregudum.sportsontheweb.net/9201896585.pdf
    • http://pixunune.sportsontheweb.net/is_harry_potter_on_amazon_prime_video_uk.pdf
    • https://cdn.sqhk.co/sunomedude/jcih5Do/sakokinurize.pdf
    • https://xexidizufom.weebly.com/uploads/1/3/4/5/134508107/1b745958c23d337.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://a519209a-2b0a-481f-9fe9-460c873bdc80.filesusr.com/ugd/270e53_e229d141c5524b889dbe8f6143184002.pdf?index=true
    • https://uploads.strikinglycdn.com/files/806c9a6f-7694-4553-90cd-69fe069f86c6/asio_digidesign_driver_mbox_2_download.pdf
    • https://6632aaff-1fe9-4f1d-acb3-7d444e457837.filesusr.com/ugd/ce4b7c_d0c2b45e15b143c582091e67cb7d37c6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/febee05a-302b-46a0-ba8d-6fb28bfb3bab/old_us_army_recruiting_posters.pdf
    • http://vufagemabon.rf.gd/telecharger_journal_echourouk_algrie_d_aujourd_hui.pdf
    • https://uploads.strikinglycdn.com/files/16f57916-6400-4b54-a6dc-cfc258ae823e/excellence_hotel_cancun_reviews.pdf
    • https://uploads.strikinglycdn.com/files/dc316d7c-a0c5-42ed-9e1b-b27ba5b9ec9b/is_the_a_sequel_to_twilight_series_on_amazon_prime.pdf
    • https://uploads.strikinglycdn.com/files/10e56b12-3c92-41aa-adb0-0fe21c9396be/kitchenaid_stove_top_cleaning.pdf
    • http://taludoxatimepup.rf.gd/84003743526.pdf
    • https://b86313a8-447b-404d-ae6d-bc69740d899e.filesusr.com/ugd/e54fc7_3b38581af63d42daa354e7af8971055a.pdf?index=true
    • http://vatodulalidi.rf.gd/present_perfect_tense_exercises_worksheet_with_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010095.bin
257f2380cd9eda4f9e8735727296c10e65c3894346bdac0a2df6316c59091ad6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10095 4844 bytes
font_01_sfnt_off00011126.bin
b3f8531c2c5d3db2ed3ac028fc13e4698601935cdafcabaaa8d5d60720f5c0a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11126 11952 bytes
font_02_sfnt_off00013978.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13978 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.