Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7c5aaab28d2207d…

MALICIOUS

PDF

108.6 KB Created: 2021-03-14 14:08:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee3b2c0c518b7962c8687145b2c2ca49 SHA-1: d368dee16e063c74139895b58ff3b2e0fee84e3a SHA-256: f7c5aaab28d2207d032aaa9bd4d77ede2313374b1523341418786b491107815b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. An external URI pointing to 'https://ponafet.ru/wix?keyword=gun+game+redux+unblocked' was extracted, suggesting a phishing or malware distribution lure. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, consistent with a generated document potentially used for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=gun+game+redux+unblocked
    • https://cdn.sqhk.co/wirowanorax/eyhajas/55109696004.pdf
    • https://cdn-cms.f-static.net/uploads/4421783/normal_600ca868f0ac0.pdf
    • http://pikejofopon.mypressonline.com/angulos_entre_dos_paralelas_y_una_transversal.pdf
    • http://towexiwi.sportsontheweb.net/graphic_designer_curriculum_vitae_format.pdf
    • https://cdn-cms.f-static.net/uploads/4369760/normal_6021aba621d93.pdf
    • https://static.s123-cdn-static.com/uploads/4392452/normal_5fe1e947cc6b6.pdf
    • https://cdn-cms.f-static.net/uploads/4494451/normal_6021ff8062c50.pdf
    • https://cdn.sqhk.co/zedugixaka/ecjg4XG/liwovumimafilobo.pdf
    • http://fesurowejo.mywebcommunity.org/92691522707.pdf
    • https://cdn.sqhk.co/tizudukokeni/Unqb6hg/verizon_mobile_find_my_phone.pdf
    • https://cdn-cms.f-static.net/uploads/4454041/normal_601ca1b4a0ae9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jemukiguwuw.myartsonline.com/administrao_financeira_internacional_eiteman.pdf
    • https://uploads.strikinglycdn.com/files/f71638a0-9c08-467e-a73d-6a0d8e4a3998/70042212458.pdf
    • https://uploads.strikinglycdn.com/files/2945651d-fada-44a1-8f8b-dfea8327bfb9/lozewalifonopazewekuj.pdf
    • https://uploads.strikinglycdn.com/files/bab5ecc1-943f-409e-9048-279fca56771f/99843250231.pdf
    • https://uploads.strikinglycdn.com/files/0af702bf-86f5-4af4-aeba-0032627af148/interview_questions_for_teacher_applicants_with_answers.pdf
    • https://uploads.strikinglycdn.com/files/a8cf2f4b-2ec1-4217-b717-b622e4080ebc/chinese_scooter_repairs_near_me.pdf
    • https://uploads.strikinglycdn.com/files/a1800aaf-c2ef-4520-b919-c3d9bfa06e2a/21553193453.pdf
    • https://uploads.strikinglycdn.com/files/f705ceaa-e8dd-46e6-9411-f275c4f1858a/65695188951.pdf
    • https://uploads.strikinglycdn.com/files/bdb01c4e-dd2f-4c5f-95fb-28e3c478e26f/tirofigomelafol.pdf
    • https://uploads.strikinglycdn.com/files/5010482b-2185-4669-91c7-6f119da96fc8/how_do_frogs_hop.pdf
    • https://uploads.strikinglycdn.com/files/975a1d85-bb32-40f6-be9c-b07cc517ceab/70824340323.pdf
    • https://uploads.strikinglycdn.com/files/9234924f-403c-4c78-b0fd-f1f39ff713bd/remifinolufozavafojak.pdf
    • https://uploads.strikinglycdn.com/files/0e95b73a-4c20-456f-a54a-c1f41341c097/garmin_etrex_30x_review_uk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016ca0.bin
43efb00bfbad01a5ca2b38dbbc4a80149a454b2c69908d0688f108db3f90e7e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CA0 5384 bytes
font_01_sfnt_off00017ee3.bin
9871dfdeac217e84e34d1c1aa249f4d2c9bda3e731ff89a177dd804106d31b8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17EE3 11384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.