Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6af3d33d8c26f95…

MALICIOUS

PDF

78.9 KB Created: 2021-04-04 17:34:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cba917450237d2686b207dfcc036dc65 SHA-1: 685f28f65368f7125fa2788d6d0ea2045b01c473 SHA-256: c6af3d33d8c26f95370537b63d3450caa8d93183dfb1c8cc033e4a9d973f2477
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking PDFs, suggesting a link farm or SEO manipulation tactic. One external URI, https://ponafet.ru/award?keyword=neuro+physiotherapy+pdf, is flagged as suspicious. ClamAV detected the file as 'Pdf.Phishing.Trojan', and an ML classifier also flagged it as malicious. The presence of embedded URLs and the overall structure strongly indicate a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=neuro+physiotherapy+pdf
    • http://liketsven.xyz/9674908613720x65.pdf
    • http://dorulezebum.sportsontheweb.net/34167823135.pdf
    • http://frasqen.online/byle_buyurdu_zerdt_en_iyi_evirih6slk.pdf
    • http://kavuxolabazili.iblogger.org/approaches_to_financial_management.pdf
    • http://microbestdigitalmeter.xyz/32922593081holpw.pdf
    • http://ig-verifiedsbadge.com/388311372643isul.pdf
    • http://private-channel.site/98980581820wyp6f.pdf
    • http://fofolep.mywebcommunity.org/mental_toughness_of_navy_seals.pdf
    • http://sinoxaju.mygamesonline.org/world_map_quiz_game_jetpunk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wikurixobelu/wokutegebutuninorireri.pdf
    • https://s3.amazonaws.com/feborobegibew/kindle_model_no_d01100_update.pdf
    • https://s3.amazonaws.com/kulinisokakewi/bakalumedowezuxutevimup.pdf
    • https://s3.amazonaws.com/baxunaf/bodybuilding_gym_workout_video.pdf
    • https://s3.amazonaws.com/guvovigo/71078682827.pdf
    • http://pifotojejanuwal.rf.gd/how_to_fall_asleep_without_melatonin.pdf
    • http://vugovule.epizy.com/bissell_little_green_machine_homemade_solution.pdf
    • https://s3.amazonaws.com/bupijila/9948835066.pdf
    • https://s3.amazonaws.com/sefiwegegagu/accord_aix_les_bains_maroc_france.pdf
    • https://cbadd540-9243-402c-beff-1b38758e3779.filesusr.com/ugd/cac9e4_134897bf80e44c82b31676333a18a1ab.pdf?index=true
    • https://62619d47-812b-4c4f-a232-aa08d86264e8.filesusr.com/ugd/6d62c1_afb42e4cd14443848f8ec5d44d536ff3.pdf?index=true
    • http://luruloligof.rf.gd/sibeburanebivopuner.pdf
    • https://s3.amazonaws.com/migivewuwe/52683527520.pdf
    • http://luregaw.onlinewebshop.net/24288692798.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f843.bin
45a61790c72c377b91225236ef0c3d18031a88bb34dbe13d0e13f369ac56191a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF843 5168 bytes
font_01_sfnt_off000109dc.bin
74028f2b7db6d1a4ab8f849db1c01e4e6a16bd64fa6ec02fcb41a949809dd963		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109DC 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.