Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7b0d203c5749b76…

MALICIOUS

PDF

83.4 KB Created: 2021-03-28 11:14:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e4e5462ce16da96e693d3a1a22274cf0 SHA-1: 787736ee477b3b4258ee0f0b24b4eccc46fa5ef2 SHA-256: c7b0d203c5749b7647bb3b9a572305484bdffa47a22da4fb3028388758b6157d
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a heuristic indicating an advance-fee scam lure, suggesting the content is designed to trick the user into a fraudulent scheme. The embedded URL, https://ponafet.ru/strik?utm_term=what+is+arby%2527s+greek+gyro+meat+made+of, is likely part of this lure. While no scripts were explicitly extracted, the presence of PDF_URI and ML_NYX_PDF_MALICIOUS firings, along with ClamAV detection, strongly suggests malicious intent, likely related to phishing or scamming operations.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=what+is+arby%2527s+greek+gyro+meat+made+of
    • http://ig-about.net/tecnicas_basicas_de_enfermeria_macmio9ycx.pdf
    • https://static.s123-cdn-static.com/uploads/4417534/normal_5ffcf206d32db.pdf
    • https://cdn-cms.f-static.net/uploads/4452386/normal_60140d0dbcfa1.pdf
    • http://flymoney.net/60985917690a2mvr.pdf
    • http://xekowij.22web.org/dijoxuruzen.pdf
    • http://xejevojesinil.22web.org/brlps_ka_answer_key_2019.pdf
    • http://help-copyrighteamservice.com/allison_3000_transmission_rebuild_manualaeub5.pdf
    • https://cdn-cms.f-static.net/uploads/4428035/normal_605eed1224940.pdf
    • http://masuxokovofa.66ghz.com/53458273233.pdf
    • http://idealica-it.website/xupikelisanumovipivum8af31.pdf
    • https://cdn-cms.f-static.net/uploads/4480743/normal_5fe7afead459d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://55f5e71c-5f54-469f-9449-301c43944234.filesusr.com/ugd/bbdb65_0c2249d0ffd140aca2cf25630bb2e0c5.pdf?index=true
    • http://nudolimugawoku.epizy.com/stoner_john_williams_movie.pdf
    • http://lijixame.epizy.com/puwukebikoga.pdf
    • http://lepeporiluvoxaj.epizy.com/11189586324.pdf
    • https://uploads.strikinglycdn.com/files/34557804-d3e8-4b93-9399-87489330a17e/how_can_you_measure_calories_in_food.pdf
    • https://a40b6db0-1679-4e03-879f-ac5827b9aa7d.filesusr.com/ugd/dba42a_cb71983d56a7494db61c0ec070112db7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dc182296-51f0-421d-9bc2-861c34ec1fd1/renexed.pdf
    • https://uploads.strikinglycdn.com/files/283c54d4-ab0b-4c8c-86b1-1979c11a494f/how_much_sodium_in_wendys_small_french_fries.pdf
    • https://uploads.strikinglycdn.com/files/6d3c7886-ff30-448d-ab43-f64b06cac763/how_to_reset_maytag_mvwx655dw1.pdf
    • https://uploads.strikinglycdn.com/files/d45cb46a-0079-430b-943a-b867d421928f/what_does_unanimous_consent_agreement.pdf
    • http://lisotabisalak.epizy.com/jakudago.pdf
    • https://ab60d57a-1f92-408f-9079-0b325776b613.filesusr.com/ugd/724fb5_e04d506ee2ae4c09b0e4c4986d871b32.pdf?index=true
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_8e2418a828214bd0ab1c14707527fc51.pdf?index=true
    • https://a1359116-1358-4cde-afc5-3600b4bb50db.filesusr.com/ugd/3b0c81_c209cc3b04294d13b111c635fa342991.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000103b2.bin
4e6c035aac17e662f76bfbd5d54cee7ec1653d1dc5775d2d649dc7090eef4f75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103B2 5644 bytes
font_01_sfnt_off000116df.bin
2810ced1fa9de5d938bc983ac4c05219b1bab8f8eaeeda9084e66a8c114e751b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116DF 11612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.