Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea9e853644225484…

MALICIOUS

PDF

78.0 KB Created: 2021-04-07 04:15:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 06852df491d8e22d9f96e7da81a49f94 SHA-1: 73370dae0ed78e91af97415240a220f12ab34b10 SHA-256: ea9e853644225484d0c7d112302f2fb088e1d1afaa9e3d461ea67f8efa5b590c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external URIs, including suspicious domains like 'ponafet.ru' and 'mywebcommunity.org', suggesting it functions as a link farm or phishing lure. The presence of embedded JavaScript, though not fully detailed, points towards potential exploitation or redirection mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=java+programming+language+pdf+notes
    • http://bewujasixi.mywebcommunity.org/videosecu_ml531be_tv_wall_mount.pdf
    • http://rumurel.mywebcommunity.org/adaptive_control_astrom_wittenmark.pdf
    • http://purubifo.medianewsonline.com/xipirerawovup.pdf
    • http://toxusuzom.mypressonline.com/pukas.pdf
    • http://kosiwixiwumizu.iblogger.org/accuracy_and_precision_in_physics.pdf
    • http://davebamonuzove.medianewsonline.com/how_to_make_a_simple_flower_in_illustrator.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bopuxosavubare/63974278621.pdf
    • https://uploads.strikinglycdn.com/files/af4dc39d-5680-4349-9315-bdab2341fad6/97283820715.pdf
    • https://s3.amazonaws.com/mufukep/femeresokefoxaf.pdf
    • http://jetotajasavesi.atwebpages.com/how_to_use_a_bosch_pof_500a_router.pdf
    • http://gagolabirej.atwebpages.com/batman_1989_script.pdf
    • http://beritoka.rf.gd/aprendizajes_clave_programa_de_preescolar.pdf
    • http://xamukipadu.myartsonline.com/ccna_dumps.pdf
    • https://c941d99d-b58b-4215-81ce-525e38db2b81.filesusr.com/ugd/2dc4cf_760816762dad4f23929dca0bb97b5eb4.pdf?index=true
    • https://s3.amazonaws.com/tazibabebamep/pajujo.pdf
    • https://4c69d07c-928c-405f-a1ab-6436392658c4.filesusr.com/ugd/4c264d_1f75f1225b5947c585419ea21b5275fb.pdf?index=true
    • https://12a3aa02-022d-4218-8efb-90aa4388683d.filesusr.com/ugd/6dfd9b_a96d7393a7fa4a86b1d7b14514c2f465.pdf?index=true
    • https://1f571a09-6495-4108-bd1a-9715deae29b5.filesusr.com/ugd/b0bf26_ab1d4243541041298293626cd2b53f9e.pdf?index=true
    • http://ximuviliduxa.rf.gd/lg_tv_repair_shop_near_me.pdf
    • https://uploads.strikinglycdn.com/files/2bfa5778-b824-43b8-adec-03d001e311cf/24052125311.pdf
    • https://4465b75e-e642-4f53-8c89-e22f0b9d4994.filesusr.com/ugd/ecd213_18977c9ee9d441ef97b7e730f2c97935.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f20a.bin
80a7c6a2af4d08314a13c2e045e0211315d2fb546d00e74ee706651bcfa7ed78		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF20A 5412 bytes
font_01_sfnt_off0001046b.bin
7e2ede52370423567fddb036f842755cb73835239006ea7596c9ec7af17842a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1046B 11384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.