Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3e9d715278e9ff9…

MALICIOUS

PDF

77.9 KB Created: 2021-03-21 01:07:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 3a39835b97a9d7370840d6c7bd1b00a2 SHA-1: 76d3dffab76104122d2a6b061ee1a76e500d5699 SHA-256: e3e9d715278e9ff9ba5dbcecf10701904582ab799c7f448a88dffd052278578a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The embedded URLs, such as https://ponafet.ru/123 and http://islta.fun/pete_the_cat_books_online_free2tt1f.pdf, are likely part of this malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=chandramukhi+tamil+movie++hd+print PDF link annotation
    • http://islta.fun/pete_the_cat_books_online_free2tt1f.pdfIn PDF document text
    • http://reduslim-shopofficial.site/dslr_camera_photo_editor_pcrzbmi.pdfIn PDF document text
    • http://beautysss.site/witcher_2_release_date33rk9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/wifukedot/nevada_series_llc_operating_agreement_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e3e187c-e46c-4df2-9940-6d03308b33ec/sharper_image_candy_dispenser_machine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae0a47ae-f05e-4072-a73a-e629b8391abc/what_is_plural_possessive_of_pony.pdfIn PDF document text
    • https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_c57f7e23657d4a6bad32278d778dbaf4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/67ba476c-01e1-4a70-b836-247d11a7b791/how_to_fix_a_camera_that_wont_turn_on.pdfIn PDF document text
    • https://s3.amazonaws.com/wokesabisevo/gisebetow.pdfIn PDF document text
    • https://2daccc73-8708-4113-a26a-4f38906335d9.filesusr.com/ugd/f65175_7b2ac5d922914855a8e42e0d9fef55ac.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zoromexemuzid/royal_mail_envelope_size_template.pdfIn PDF document text
    • https://s3.amazonaws.com/petuzutemixuvod/bcom_information_systems_bursaries_2019.pdfIn PDF document text
    • https://e9b66cc5-9289-431c-8f17-6739e1cd2d88.filesusr.com/ugd/c8f33b_5e5cba70a9cd43da8bdf14a97c65373a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kefodek/spanish_alphabet_worksheets_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e77314e8-c740-4d2c-b33d-5c59e1b3155f/the_cat_in_the_hat_knows_a_lot_about_that_full_episodes_youtube.pdfIn PDF document text
    • https://s3.amazonaws.com/tisegovofu/lavonusotigifavotezetu.pdfIn PDF document text
    • https://s3.amazonaws.com/limewub/dixuwojezerujixag.pdfIn PDF document text
    • https://ba10d46a-d7c1-43af-8542-f1a50f31aa8a.filesusr.com/ugd/4dded2_9a33a772324748678ce264de0dbba3fd.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/619bb174-6d15-4565-b5eb-d732cb060136/kozasizisitusiwutilofa.pdfIn PDF document text
    • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_8976319168154816bb49cbe871f4bcb2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2A8 5052 bytes
SHA-256: f1598087dcc1c3a3337a5761043dc0b0df82605ac99f19df8f080321880372c7
font_01_sfnt_off0000f3a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3A6 3644 bytes
SHA-256: a41afbd109a34455fa051dff46279ed2fbc32c115f38907e34dcb9547e236c04
font_02_sfnt_off00010162.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10162 12388 bytes
SHA-256: 40e0a059d20866dc405f8f2add41967565e7135b223cf124a8ca3e7f3852da3b

Open this report in the interactive analyzer, or submit your own file for analysis.