Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0cd03e529a56b3d…

MALICIOUS

PDF

89.8 KB Created: 2021-04-08 08:44:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2afe5cd8eaca7029f7a4a78f944b2489 SHA-1: 02ce74d83887c92efae7d871542f3d92bab3e688 SHA-256: e0cd03e529a56b3db83391e91aeb6d3657523539814870675855a656e59b5281
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, forming a link farm, with the primary URL being 'https://ponafet.ru/wix?keyword=dark+cloud+guide'. This suggests the document is designed to redirect users to potentially harmful content or to manipulate search engine results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=dark+cloud+guide
    • https://cdn-cms.f-static.net/uploads/4367687/normal_601fb05bbc03e.pdf
    • https://cdn-cms.f-static.net/uploads/4426945/normal_600b4fd579461.pdf
    • https://cdn-cms.f-static.net/uploads/4379973/normal_6053223d2c6e0.pdf
    • https://cdn-cms.f-static.net/uploads/4372673/normal_604632b34f1be.pdf
    • https://cdn-cms.f-static.net/uploads/4413017/normal_6063af84651cb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/08b420e0-174a-460e-92a0-13a3f768a107/fegenibavodiwo.pdf
    • https://84bd2c60-91d0-47b6-9565-6ae8a6593e58.filesusr.com/ugd/963627_214a98b5d2c44447a181cbafd4aa9fae.pdf?index=true
    • http://kalilom.epizy.com/weather_fronts_worksheet_answer_key.pdf
    • https://8137cd1e-393d-4948-8193-eca935452849.filesusr.com/ugd/756799_9c0e415ff43941a596b34bfc65bfa4e1.pdf?index=true
    • https://44879a12-c10a-431c-a98a-7de142752d0f.filesusr.com/ugd/bb4607_c6c1f33427de4e19865670c23856a355.pdf?index=true
    • https://807eaacf-9fb6-4e16-bcb8-061395d1d132.filesusr.com/ugd/a3ef2e_983e5fc98a2645b0abda92118222b67d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5ce6014c-5946-4081-b682-acfe6d4a9bf9/3492020136.pdf
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_73fb1945523e4b7184f036583b7a10bc.pdf?index=true
    • https://uploads.strikinglycdn.com/files/be81531b-a70b-46c0-86c1-55559d065930/20983300885.pdf
    • https://s3.amazonaws.com/julaxel/what_setting_is_the_coldest_on_refrigerator.pdf
    • https://s3.amazonaws.com/divexikav/wuwenenuxub.pdf
    • https://s3.amazonaws.com/rujimidujek/19050141387.pdf
    • https://5d94d51b-2702-4b64-8df3-eadd022f3edc.filesusr.com/ugd/2ddd39_73351b3f54034e95b74ef9eec9555f26.pdf?index=true
    • http://zodadep.epizy.com/96394517409.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012368.bin
3662aef2145f44fe90634498d8892571fcf429c40cb2349877ea09a414ba3196		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12368 4992 bytes
font_01_sfnt_off00013478.bin
bc653749d534cc039730a51b82bc103618e9816de5c9244e6568fe41a1fba2a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13478 11136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.