Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2e54e5651a3872f…

MALICIOUS

PDF

363.8 KB Created: 2021-05-21 22:41:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 582b2fecf1291fa03a15d2147a90e19f SHA-1: 7e3e8a902498c9b1023be2d5020d176ab794c7b9 SHA-256: e2e54e5651a3872f4562da7a9928d34a41b837cf9e3a449c1c30a483844b4cea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains multiple embedded URLs, with the primary one being 'https://ponafet.ru/strik?utm_term=cinema+rio+70+monterrey+john+milton', suggesting a phishing or malware distribution lure. No scripts were extracted, but the presence of external URIs and the overall detection profile points towards a malicious document designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9712

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=cinema+rio+70+monterrey+john+milton
    • https://saniluje.weebly.com/uploads/1/3/4/3/134323688/jokavajuzunage-lumulam-ruvutux-nozodev.pdf
    • https://pusuwane.weebly.com/uploads/1/3/5/3/135346572/426499.pdf
    • https://bofazereb.weebly.com/uploads/1/3/4/6/134675062/adb02b.pdf
    • https://magudutetu.weebly.com/uploads/1/3/1/4/131437318/1819325.pdf
    • https://xavidupi.weebly.com/uploads/1/3/4/7/134723560/2620837.pdf
    • https://static.s123-cdn-static.com/uploads/4462976/normal_5fe568e1a131d.pdf
    • https://cdn-cms.f-static.net/uploads/4413968/normal_6068dfa8ec006.pdf
    • https://cdn-cms.f-static.net/uploads/4501212/normal_600bc14531a01.pdf
    • https://cdn-cms.f-static.net/uploads/4461207/normal_604a207da3913.pdf
    • https://wuxelulomevadi.weebly.com/uploads/1/3/4/9/134904547/190fbd.pdf
    • https://static.s123-cdn-static.com/uploads/4420230/normal_5ffa7c4891d8e.pdf
    • https://cdn-cms.f-static.net/uploads/4481291/normal_605c0db405509.pdf
    • https://repemokalit.weebly.com/uploads/1/3/1/8/131856723/1086651.pdf
    • https://nisofopirumo.weebly.com/uploads/1/3/4/4/134478351/mupijufimaxos.pdf
    • https://sofakixejiz.weebly.com/uploads/1/3/4/2/134265497/duruvak_bisitodoxuvok_tozibud.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/titugome/danigedakofiwopaja.pdf
    • https://uploads.strikinglycdn.com/files/02a41bc6-1e55-4bef-8457-278a896b0c83/what_is_chlorophyll_found_in.pdf
    • https://s3.amazonaws.com/tokudapele/28757366381.pdf
    • https://s3.amazonaws.com/tojazudibumogab/dumasetujejo.pdf
    • https://uploads.strikinglycdn.com/files/368d9314-393b-4f96-817a-1f501a132ba8/itil_foundation_certification_cost_in_chennai.pdf
    • https://s3.amazonaws.com/gavobawum/manual_camara_canon_eos_rebel_t7i.pdf
    • https://s3.amazonaws.com/gapivegek/budget_2019_summary_upsc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000560af.bin
08bd668b8e5407c27f6ae9551b095ead4ad18f9c966e1437a50d02323c53ce09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x560AF 5052 bytes
font_01_sfnt_off000571b4.bin
e20efc4c1c123461747a476a132d6171d59f1aa15de7019c9107b9422f8b465d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x571B4 17324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.