Malicious PDF — malware analysis report

Static analysis result for SHA-256 f46b6f6ec20cf65d…

MALICIOUS

PDF

71.5 KB Created: 2021-03-10 16:20:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f038bba657917047c5cf8b4c97c6bca SHA-1: da7239e5ab92d53a9d57adac5438c38231b922b9 SHA-256: f46b6f6ec20cf65d87611a241fb23a7926cc3e7754edfa1cdc32b8f7d3fef2a7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, many pointing to PDFs hosted on various domains, suggesting a link farm designed to obscure the malicious destination. The primary malicious URL identified is https://ponafet.ru/award?keyword=a+level+psychology+past+papers+pdf, which likely serves as a lure for users seeking academic materials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=a+level+psychology+past+papers+pdf
    • https://static.s123-cdn-static.com/uploads/4367303/normal_5fe0435857b8c.pdf
    • https://pobunusegem.weebly.com/uploads/1/3/4/4/134460984/6576283.pdf
    • https://pozivikebesar.weebly.com/uploads/1/3/4/7/134759309/81a03.pdf
    • https://somotudodij.weebly.com/uploads/1/3/4/6/134699902/1194309.pdf
    • http://bloodcraft.online/mcgraw_hill_texas_algebra_1_answersuqijw.pdf
    • http://mukijekupivi.22web.org/xfinity_stream_app_on_ps4.pdf
    • http://womenit.space/akbarnama_in_english_freeau6ke.pdf
    • https://rupasofo.weebly.com/uploads/1/3/4/8/134892789/7391871.pdf
    • https://gusijanuvo.weebly.com/uploads/1/3/0/8/130874241/2982805.pdf
    • https://cdn-cms.f-static.net/uploads/4461773/normal_601363ca1c446.pdf
    • http://gixipures.sportsontheweb.net/76701121755.pdf
    • http://wexakevo.22web.org/piwijatejadupesiduwasiz.pdf
    • http://mavigawika.scienceontheweb.net/hoover_floormate_deluxe_hard_floor_cleaner.pdf
    • http://dotenipago.medianewsonline.com/castrol_power_1_racing_10w50.pdf
    • http://lakegefufen.scienceontheweb.net/wozasinuvom.pdf
    • https://cdn-cms.f-static.net/uploads/4446944/normal_6036b514598f2.pdf
    • http://igme.site/nekulezudobusunrcf8y.pdf
    • https://cdn-cms.f-static.net/uploads/4456166/normal_600a7b47bb811.pdf
    • http://walolexokesufa.sportsontheweb.net/how_to_sharpen_stihl_ms170_chainsaw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_d006376982a947f7a370210935368ca9.pdf?index=true
    • http://kozifina.epizy.com/what_is_the_fastest_way_to_learn_guitar.pdf
    • https://276658a2-c6b1-4a23-bc3b-56c82bce4278.filesusr.com/ugd/f9448a_e6885a50e6f5480ca663635064554541.pdf?index=true
    • http://regojefef.epizy.com/funopunifowimutobiv.pdf
    • http://dimarujevetuvif.epizy.com/adobe_acrobat_reader_for_ubuntu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb91.bin
ba86e131169d123b000e7509ef4a18b4cd6393b6c8690b484b90e2148339e2d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB91 5204 bytes
font_01_sfnt_off0000dd6b.bin
0fea3b42549c145e2f30ab010b402ea47da4407f9e478fc5e23f8a3709893700		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD6B 10588 bytes
font_02_sfnt_off000101ae.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101AE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.