Malicious PDF — malware analysis report

Static analysis result for SHA-256 067fcc699b7d9b70…

MALICIOUS

PDF

91.4 KB Created: 2021-03-17 21:33:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c0b739417a2402f05aa9d3460c77a61 SHA-1: b95086de450c2b83f5aa3b6d176e1cc7d451e540 SHA-256: 067fcc699b7d9b706327a714abf83c59462968d6c1c1d8cdc8020766757c0ab8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'golowaki.ru', which is likely a malicious domain used for phishing or distributing further payloads. The document body, though heavily obfuscated, contains references to '5 nights at freddy's 4 unblocked', suggesting a lure to attract users to the malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=5+nights+at+freddy%2527s+4+unblocked
    • https://static.s123-cdn-static.com/uploads/4463810/normal_5ffe6df323dcf.pdf
    • https://cdn-cms.f-static.net/uploads/4369512/normal_60403b2a862cd.pdf
    • https://cdn-cms.f-static.net/uploads/4425759/normal_604e3a05d398a.pdf
    • https://static.s123-cdn-static.com/uploads/4378848/normal_5fec235b7ca5f.pdf
    • https://static.s123-cdn-static.com/uploads/4373987/normal_5ffe928a07659.pdf
    • https://cdn.sqhk.co/nupegefozub/iibYrTG/katef.pdf
    • https://static.s123-cdn-static.com/uploads/4459777/normal_5ff6548ea10d6.pdf
    • http://dress-russia.ru/how_much_horsepower_does_a_2015_ford_mustang_gt_haveannmi.pdf
    • https://cdn-cms.f-static.net/uploads/4455884/normal_603b9fc7bb99b.pdf
    • http://fashion-deals.xyz/hdfc_bank_ltd_dd_formp42ke.pdf
    • http://zhenskiizhurnal.ru/4564626640ppxtg.pdf
    • https://static.s123-cdn-static.com/uploads/4384835/normal_5fee61f24bd41.pdf
    • https://cdn-cms.f-static.net/uploads/4480148/normal_604353c6a7c0e.pdf
    • https://cdn-cms.f-static.net/uploads/4479718/normal_603f499b39a81.pdf
    • https://cdn.sqhk.co/busumodofu/Yzjiia0/armorseal_8100_data_sheet.pdf
    • https://cdn-cms.f-static.net/uploads/4489583/normal_600e44a19c6ab.pdf
    • https://cdn-cms.f-static.net/uploads/4453142/normal_60141a09d96cd.pdf
    • https://static.s123-cdn-static.com/uploads/4473622/normal_6009622461517.pdf
    • https://cdn.sqhk.co/nomelafu/Istjcjf/50099501509.pdf
    • https://cdn.sqhk.co/ragonujip/cCtjexr/clash_of_clans_ultimate_gems_and_coins_generator.pdf
    • https://cdn.sqhk.co/wememiguw/ehihe5j/killer_bean_unleashed_download_apk.pdf
    • https://cdn.sqhk.co/lopumilekana/bbKgcji/bepelunotinebaf.pdf
    • https://cdn.sqhk.co/gotofebelu/rSidhiI/best_free_usa_dating_app_2020.pdf
    • https://cdn-cms.f-static.net/uploads/4390074/normal_5fd5f00f62fb5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000110dd.bin
6a3738e6c678474192bd64d44163f9c8930279b23ddb84f9cce6605380db05f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110DD 5740 bytes
font_01_sfnt_off0001247d.bin
7a8fdf00f192615110194537ccdae6632e89cf8c29f917b299093c889c961959		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1247D 10848 bytes
font_02_sfnt_off000149ab.bin
52db30b66cfb76898988bc7c6ed152514c301740808ab95bec9c68e49df23550		 pdf-font-stream PDF embedded font (sfnt) at offset 0x149AB 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.