Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3dff8b0eb4094d8…

MALICIOUS

PDF

74.3 KB Created: 2021-04-08 04:21:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 86f32411f3a4de98974a502957611fb0 SHA-1: b6efa979a7ccc94a42e20e30133e80c8b1be4ddc SHA-256: c3dff8b0eb4094d83944644f39b72648926ef0024f1ee4d4c315f3aa63ebe06c
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or trojan delivery mechanism. The presence of a fake CAPTCHA heuristic suggests an attempt to deceive the user into performing an action, likely to download a secondary payload or visit a malicious URL. The document contains numerous external links, including one pointing to 'ponafet.ru', which is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=teatro+en+casa+sony+bdv-e2100+manual
    • https://cdn.sqhk.co/romekeka/jjVOkid/parent_cue_podcast.pdf
    • https://static.s123-cdn-static.com/uploads/4465274/normal_5ff9ca5605cc2.pdf
    • https://cdn.sqhk.co/rolidofajug/epyrhjh/jugenonixoguzet.pdf
    • https://cdn.sqhk.co/sategexarom/ghwhigf/63955342070.pdf
    • https://cdn.sqhk.co/tusadopovet/cdQhfhb/gta_vice_city_stories_apk_file.pdf
    • https://static.s123-cdn-static.com/uploads/4378165/normal_5ffa0f772cdd8.pdf
    • https://cdn-cms.f-static.net/uploads/4424349/normal_602e85ad86b9a.pdf
    • https://cdn-cms.f-static.net/uploads/4453334/normal_603f3ed89857d.pdf
    • https://cdn-cms.f-static.net/uploads/4375886/normal_6024ad3952544.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5c817321-7c0c-448b-959d-deb1da9fd788.filesusr.com/ugd/19103d_2842d603e4f04f3ca1c460887994268c.pdf?index=true
    • https://3cd6846c-369c-4875-9c63-132df726a2dd.filesusr.com/ugd/7ab50f_1f507f16153d4ae3899c592c35ade902.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e4cbf14d-7453-4be1-b209-f4f913555982/46892858091.pdf
    • https://67389751-14cc-4ed3-b660-7ef7239e4cc3.filesusr.com/ugd/bb5584_8230ddcc749f49758e65bd2e216722f7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/df888a39-b3b3-4621-9b9f-53f7eb68f597/buenos_das_mi_princesa_hermosa_carta.pdf
    • https://uploads.strikinglycdn.com/files/5ee727df-99be-463a-b4d3-516485746ca8/bukelap.pdf
    • https://uploads.strikinglycdn.com/files/c390e4db-34b3-46b6-9d96-ccfcb1b4575a/how_does_lpg_automatic_changeover_regulator_work.pdf
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_9781ee5e189c4c2eb4fd47345620193c.pdf?index=true
    • https://61090d85-22e6-4724-b969-52a17785150c.filesusr.com/ugd/952c2e_59aaaea83d674070a686550f08a22f09.pdf?index=true
    • https://a2214900-82f6-4ed5-a432-d5ffd14110fa.filesusr.com/ugd/306b6b_94b7fb3f8c37449dae924b350d70104e.pdf?index=true
    • https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_f59839f2f72a4a2eaac41e8235e8d4d3.pdf?index=true
    • https://3eeb541e-75be-486c-a732-b1e279b2a932.filesusr.com/ugd/eaab1c_9c82c9ea30b741879dc443c2d450d945.pdf?index=true
    • https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_2f0b4258fff8453f9aa3df751d34b793.pdf?index=true
    • https://cf4de027-7369-46c2-bf93-d69cabef2b5e.filesusr.com/ugd/868b90_1062a5a4330949dea0ede662cac781ee.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbf0.bin
65e11477b5f8398e7534863155051bad5939a447f03239c612e0c5cb97ba5f67		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBF0 5696 bytes
font_01_sfnt_off0000ef4d.bin
78bc0abc382e435b924be86203fc8228efd73edf19063efcd99b9c9e6e5aa1b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF4D 13652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.