Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc3914a8e6434039…

MALICIOUS

PDF

86.5 KB Created: 2021-05-06 18:58:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60560dd1e209917d1b40604ffeb75358 SHA-1: 25067b1d415aa45f2de0fd87e5f7b22da5cbe063 SHA-256: cc3914a8e6434039440e335dc74024f4afd74291db29b198fc259e713ec6381f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external URIs, many pointing to disposable hosting, suggesting a link farm or redirection scheme. The primary malicious URL identified is https://ponafet.ru/strik, which is likely intended to deliver a secondary payload or redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=how+to+troubleshoot+a+tankless+electric+water+heater
    • http://defi-bet.world/bob_marley__the_wailers_-_redemption_song_meaningmeb42.pdf
    • http://toportt.online/34771238287mtg0r.pdf
    • http://filfex.ru/all_functions_in_python9n44w.pdf
    • http://voirly.xyz/vaxinokasuredonurakvb6j.pdf
    • http://bridgecommerce.com/pebugotutuponigeladornmgg5.pdf
    • http://gevazuvunurodum.22web.org/reporte_de_calidad_del_aire_en_mexicali.pdf
    • http://fusitekive.iblogger.org/79016515136.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/174d8626-8e04-4892-9093-134abe981b38/70758462110.pdf
    • https://s3.amazonaws.com/wujanozo/sirilikarevojufekebabugi.pdf
    • http://tosabukevosubar.myartsonline.com/biodata_format_for_muslim_marriage_free_download.pdf
    • http://tuzikarowom.epizy.com/5927756260.pdf
    • https://748f1d53-d141-46c1-926a-d14fc69713a3.filesusr.com/ugd/e3ed1f_e0d413a739fb4da4b96f0a8e236bbe3d.pdf?index=true
    • http://nibemodida.myartsonline.com/4598972808.pdf
    • https://s3.amazonaws.com/gasodamuza/20017459261.pdf
    • https://uploads.strikinglycdn.com/files/bdfb2f46-5169-4e49-ab5d-51e493406bfd/five_night_freddy_apk_full.pdf
    • http://wagadepepixapu.epizy.com/android-_x86-_6._0_marshmallow._iso.pdf
    • https://6f672a44-e16c-4921-a0f1-e3781c0647c5.filesusr.com/ugd/bda22a_441344cd7fa74919acec8c5e17fd6170.pdf?index=true
    • https://s3.amazonaws.com/matogapibelifiv/4th_grade_multiplying_fractions_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/a4c9b969-90ef-480b-8ef7-e5f53b8cda2a/43835299561.pdf
    • https://1527c8d3-3321-4e9f-872f-e2bebb57bac2.filesusr.com/ugd/bf2d42_4e77427673b84b30893ab04796e23abb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c3ff3a59-eaeb-473e-9712-beae5b7b375b/does_wic_give_u_formula.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011467.bin
178fc9e258e4eae80a0892d8e6f3b2c413da05791f084eda492fa6bcd8047db4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11467 5144 bytes
font_01_sfnt_off000125eb.bin
85a2fad369d5538c63ead764871729507069882e970f1296924834e23d36c50c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125EB 11292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.