Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfd96a89740a5245…

MALICIOUS

PDF

76.3 KB Created: 2021-03-08 20:41:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e115ef9134854e9b1b0be5d8c2b268b7 SHA-1: 7bcb0d98d957665196e214d7b06bbf73b3b8bb07 SHA-256: cfd96a89740a52456867bf4e5f8589231bf4f10d31ea1c995475836f2c1f9925
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified as a link farm, with one prominent URL pointing to 'ponafet.ru'. ClamAV detection as 'Pdf.Phishing.Trojan' and ML classification strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded links suggest a phishing or malicious redirection attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=rifts+rpg+dimension+books
    • https://lulujazopo.weebly.com/uploads/1/3/4/7/134769354/karuf_vuxobekat_podixejaneweva_filatakusupi.pdf
    • http://bejisosubonito.sportsontheweb.net/is_lincoln_continental_a_good_car.pdf
    • http://kifopelidito.mypressonline.com/mad_school_karachi.pdf
    • https://vuverararusug.weebly.com/uploads/1/3/4/8/134883490/nulavafisu-bejefavixoroxi-rovelipipo.pdf
    • https://pevumufaropis.weebly.com/uploads/1/3/4/7/134706438/bosupipakopawer_dajuj_tedazotefe.pdf
    • https://xonujofepip.weebly.com/uploads/1/3/4/3/134385468/gavuvoze.pdf
    • https://nunipotewisi.weebly.com/uploads/1/3/4/8/134892443/d454db5e6.pdf
    • http://jaralet.getenjoyment.net/which_engine_works_on_otto_cycle.pdf
    • https://cdn-cms.f-static.net/uploads/4384036/normal_60251ba86eba9.pdf
    • http://gejesixave.scienceontheweb.net/lange_psychiatry_10th.pdf
    • https://sogitinavebifi.weebly.com/uploads/1/3/5/4/135400198/850314af43ae1.pdf
    • https://sijalafad.weebly.com/uploads/1/3/4/8/134887162/8121567.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1618b3f4-dcc0-4047-a816-eeb1cbe43c51.filesusr.com/ugd/a01749_8e83f7a3818848b3a8b996ae7f048533.pdf?index=true
    • https://uploads.strikinglycdn.com/files/212546d7-675e-49d3-a22b-bac5202fbf6d/vorekuvejekitinalesufizuk.pdf
    • https://uploads.strikinglycdn.com/files/8a059106-04f9-40b5-911b-0d173af77d6b/95421631093.pdf
    • https://uploads.strikinglycdn.com/files/7093aa4d-eee3-46f8-bce0-1fe361d23a58/51901705918.pdf
    • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_b859246452114119b280b5c7480d4fd2.pdf?index=true
    • https://413f70bc-0247-4a04-a3fc-eabb14e2b93f.filesusr.com/ugd/f18ee6_8fab778e25294171bc4778989d20d778.pdf?index=true
    • https://uploads.strikinglycdn.com/files/42d10dfc-62d5-49bf-a0a6-7c0479cd2484/constitucion_de_puerto_rico.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecc9.bin
639ecce2d6c39887d14dde7f884dd86bd21dc955340bc2b30a12fea8b07bda05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECC9 5328 bytes
font_01_sfnt_off0000fee0.bin
c5c79065e4a8a341aa8e0c3d8f323498531f3417e27266d0d6da3f000edcee24		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE0 10836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.