Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2103c430b67b157…

MALICIOUS

PDF

78.1 KB Created: 2021-05-21 08:48:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: f4d7a50f393850be9e3b79c9be715b2d SHA-1: 2ef9e69215c107086bcb9f9fea65d575a690245a SHA-256: e2103c430b67b15733f834aed36c11a9d26637fbc99206d29ba4239ceff547ee
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF_SEO_LINK_FARM' suggesting a large number of outbound links. The ClamAV detection and ML classifier strongly indicate maliciousness, with 'Pdf.Phishing.Trojan' being a key identifier. The primary malicious URL identified is 'https://ponafet.ru/strik?utm_term=what+color+is+skin+without+blood', which is likely used to redirect users to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=what+color+is+skin+without+blood PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4500438/normal_5fd164b9711e3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483088/normal_5ff9d85280fe4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374847/normal_5fcd77507ca1a.pdfIn PDF document text
    • https://dobopekajami.weebly.com/uploads/1/3/4/3/134314215/gamenunebidi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481663/normal_5fda72973f7cc.pdfIn PDF document text
    • https://naziwimirup.weebly.com/uploads/1/3/4/3/134371197/718fec51acd8e6.pdfIn PDF document text
    • https://mazakodavowur.weebly.com/uploads/1/3/4/3/134335882/bumetelesegizufafu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/240682c7-351b-47eb-97c0-b255eef9f303/python_programming_for_beginners_ppt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce511756-e462-4145-b5ea-d43827213d4c/42950736000.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61464365-97f5-44da-bdbd-f1dd759d8778/bajoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b84efc32-0f56-4328-a81d-c9d086f0ea1f/dont_rest_your_head_powers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8409e833-57f7-45f7-8c4a-bfb6dc1621f9/50530974029.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5bf8d8f-8758-4495-90bc-94a15acb8ab1/how_to_look_up_serial_numbers_in_sap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9bdbcb09-b27b-42fb-990f-86a1b33ce818/11943412485.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a30b3c3b-4fb1-405f-89d3-51d64315d8ee/how_long_do_you_cook_a_turkey_in_an_electric_fryer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c160bf35-37fb-46b6-bbb7-e719927ce56b/linux_terminal_command_cheat_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5095e754-e50b-4620-a05b-d84d8721fbf4/daluvedagebajevizax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e30bdc22-9937-46f9-9b01-c4be32ebef13/affidavit_format_word_file.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/969f733a-44bf-4231-8d2d-6e2a4849a306/zomaledipirabeweboxuruwok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15a95a6e-1cf9-4014-a375-8c12f568ba76/good_sun_tzu_quotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bac69ea2-130b-4537-9472-fa1325c8932e/how_long_will_a_2001_crown_vic_last.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3BC 5336 bytes
SHA-256: 8350134a8cfe3f5b556838ac36a39dc70d70a57000bc6227272a6423eace873b
font_01_sfnt_off000105f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105F0 10960 bytes
SHA-256: 2f2602514373f79209dc4c859b1444ccf750af667ab6ba538259ac7551162445

Open this report in the interactive analyzer, or submit your own file for analysis.