Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe5d0b74e6b80b8d…

MALICIOUS

PDF

81.9 KB Created: 2021-03-20 10:11:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f3191d12a8cc70273e116860aa682eca SHA-1: 750f9f8e4901a8eed3c1fc0256df900650cbe322 SHA-256: fe5d0b74e6b80b8d1335b6cf9c87bfd359cf7f45b5dc8268e6e92c539d57537a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains a large number of external links, including one to `ponafet.ru`, which is likely part of a link farm to obscure the final malicious destination. The presence of PDF-specific heuristics like PDF_SEO_LINK_FARM suggests an attempt to manipulate search engine results or distribute malicious content through a network of linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=the+cell+worksheet+pdf
    • https://jixawapideraje.weebly.com/uploads/1/3/3/9/133997308/1362005.pdf
    • https://zalorapowil.weebly.com/uploads/1/3/1/8/131871687/9960476.pdf
    • https://lexawuvake.weebly.com/uploads/1/3/4/6/134610488/27453e114d0afb4.pdf
    • https://nexirexosevexos.weebly.com/uploads/1/3/4/5/134500935/5b7ea82f9.pdf
    • https://faxomozux.weebly.com/uploads/1/3/0/7/130775398/0ce649165cf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/jujadodedaruxix/34544181134.pdf
    • https://uploads.strikinglycdn.com/files/bc1da269-54bd-4a32-87b4-16e56cd9e4c3/bubofokuwukuxefuloriwum.pdf
    • https://uploads.strikinglycdn.com/files/708a0dd2-aa70-4491-a5fb-aa18d4aa54ee/jorugalutarogareremos.pdf
    • https://uploads.strikinglycdn.com/files/bce7cf50-30e1-4678-b396-0aa680ae2a6d/75178043036.pdf
    • https://s3.amazonaws.com/kezemiradigu/68396168855.pdf
    • https://uploads.strikinglycdn.com/files/6b84c798-2589-46ba-8654-3fc741bccfa5/furidaxasidezove.pdf
    • https://uploads.strikinglycdn.com/files/715df3f0-2f88-42a9-a8ff-c11fb4294103/sozurunoferikelikuzaleta.pdf
    • https://s3.amazonaws.com/toliwudalamem/english_movies_free_sites.pdf
    • https://s3.amazonaws.com/jadudusujuje/japebelijiguboz.pdf
    • https://uploads.strikinglycdn.com/files/e82fa0f4-2a62-4514-8f93-aeb3d872b72f/what_kind_of_transmission_fluid_does_a_2006_chevy_malibu_take.pdf
    • https://80b1f93a-fe74-4439-a81d-34814fa7a505.filesusr.com/ugd/e56fe2_fa3f3ba2299e4a7bbaced43628748653.pdf?index=true
    • https://s3.amazonaws.com/bubeto/kizafekakadotofa.pdf
    • https://uploads.strikinglycdn.com/files/b765f91a-1cfc-46c6-bf39-b18160b795c6/mivowugaxasiralotozig.pdf
    • https://59548cc9-d6a6-4b2e-bd73-2bfb7290c7b5.filesusr.com/ugd/3fd21f_eff8987f73c14643bb187b8eebfb47b3.pdf?index=true
    • https://07e0a16e-b77d-475b-b724-88bbaedb347c.filesusr.com/ugd/8e9e2f_0882b96bd39245c3a979bb8aa32e1308.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6b296a36-4d65-4f82-a6c1-be830a26a2c2/wotagujavogetuf.pdf
    • https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_f5264082f31a46f49fb634558bb43134.pdf?index=true
    • https://s3.amazonaws.com/vipuxafol/cash_app_pending.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f62a.bin
39e1e2921ade480c8e9d42b3a17cd306519e881102bde0064200ce86fd06fcf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF62A 4772 bytes
font_01_sfnt_off0001068c.bin
ee1ed2d130e427321cf7deb5e9cbe067d7a9e37d9f059df70d7a182202ce4695		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1068C 11008 bytes
font_02_sfnt_off00012c00.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C00 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.