Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3de321326b51ea4…

MALICIOUS

PDF

77.8 KB Created: 2021-03-27 14:33:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1fa69ada268be6cbb992795d5746da4f SHA-1: 2367462cb04424e9edbcb825c5af9cf0eb80def0 SHA-256: f3de321326b51ea421c731f51ee567af5395672cd51abcc875c43382fba2b112
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. The presence of an external URI pointing to 'ponafet.ru' and a heuristic for a visual download button suggests a phishing lure. Although no executable scripts were extracted, the PDF structure and external URL indicate an attempt to trick the user into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=census+2020+pdf+affairscloud
    • https://cdn-cms.f-static.net/uploads/4476002/normal_60354d9467c63.pdf
    • http://dostafood.xyz/accident_report_bbc_newsyshnq.pdf
    • https://wavopotajulaja.weebly.com/uploads/1/3/4/6/134631105/8078597.pdf
    • http://kellys.space/can_brother_hl-2270dw_airprint2f9ja.pdf
    • https://static.s123-cdn-static.com/uploads/4500893/normal_5fdf21f7b5584.pdf
    • https://xadafujivesa.weebly.com/uploads/1/3/1/3/131397927/4885a88ad4d633.pdf
    • http://wonnaturila.space/how_to_lose_weight_fast_while_eating_junk_foodbc5tv.pdf
    • https://cdn-cms.f-static.net/uploads/4366057/normal_5fd1ab86ad6fd.pdf
    • http://blubadgehelp.net/australia_road_death_toll_2017jqrwv.pdf
    • http://espaceclient-cmb.com/what_bible_says_about_adulteryo476c.pdf
    • http://remont-kvartir-otzyvy.moscow/nolosofajoxofubalodawej66d6.pdf
    • http://levelupguild.com/dave_ramsey_baby_steps_youtubel9dlk.pdf
    • http://brumbum3.xyz/38628483815xrpxx.pdf
    • https://feropozu.weebly.com/uploads/1/3/1/4/131454035/labukenikibeg_japunoxivu_malijuxiwitamam_soxavowogatetuf.pdf
    • http://bitcoinlearningcentre.online/9.3_naming_and_writing_formulas_for_molecular_compounds_worksheet_answer_keyicv3e.pdf
    • https://pagukusiko.weebly.com/uploads/1/3/4/6/134631218/6e7fb.pdf
    • http://help-copyrighteamservice.com/cub_scout_logo_vector_free33qil.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_60ff14d43b2647fb97f9d31af482ac76.pdf?index=true
    • https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_828e5a13c41d4c3da33897b155a3e169.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f542212b-c761-498a-aee9-5b9ede34bbe8/what_is_the_meaning_of_new_wine_skin.pdf
    • https://uploads.strikinglycdn.com/files/7d55ed50-8975-46b2-b4f5-1fc05339eba2/harry_potter_characters_patronus.pdf
    • https://uploads.strikinglycdn.com/files/b4ef464f-6c32-40d1-9c37-14d553bacee5/masekiboxeb.pdf
    • https://uploads.strikinglycdn.com/files/a6679f99-ef11-4438-9c15-ac9ab16a05db/how_can_i_help_my_5_year_old_with_social_skills.pdf
    • https://uploads.strikinglycdn.com/files/eeb8f2d3-6f23-40c4-9a95-c70b9f45bcbe/how_to_lie_with_maps_summary.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f18c.bin
4dc146aa7fbbfedaba1295bdc903f11cb802fd63548029e7a35e292d7feb3db1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF18C 5328 bytes
font_01_sfnt_off000103ba.bin
9c583ab086d720fe153485ea419c75ba5a55c45ffdfc3ef1ee67e9725fde1ddd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103BA 11212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.