Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a6a877bdeb7a345…

MALICIOUS

PDF

69.0 KB Created: 2021-03-30 16:25:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: c0a80fb4b29eb47f8c66f8f0aeb8a1dc SHA-1: 7a779d4ffa7d33dcd529e581aff831bb7413cdd7 SHA-256: 1a6a877bdeb7a345afec7a97e3824d0c6fea8a003521b1b58c22414c0bb8031b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with at least one pointing to a domain ('golowaki.ru') associated with potentially malicious activity. The presence of multiple external links suggests an attempt to redirect users to phishing sites or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=auriculotherapy+manual+terry+oleson.+pdf PDF link annotation
    • http://wide-do.top/mufokivp2ew2.pdfIn PDF document text
    • http://shlifovka-pol.website/kusaxemeow5i6.pdfIn PDF document text
    • https://cdn.sqhk.co/lomabufu/q2hiPYQ/63154907913.pdfIn PDF document text
    • http://hurleyshamburgers.com/kitchenaid_pro_600_series_6_quart_bowl-lift_stand_mixer_-_aqua_skyx2c6f.pdfIn PDF document text
    • https://cdn.sqhk.co/tisezalave/LNhagiC/amazon_driver_application_status.pdfIn PDF document text
    • https://cdn.sqhk.co/ropimipaf/ejchfdV/fejuvozopaxesibudevo.pdfIn PDF document text
    • http://replyua.site/deep_braille_tome_dark_souls_3n8t7v.pdfIn PDF document text
    • http://musofiron.ru/agent_vinod_movie_openloadtcrfe.pdfIn PDF document text
    • http://xviiivbgz.com/jasabari76li5.pdfIn PDF document text
    • https://cdn.sqhk.co/gulanuwe/qThijgt/calendar_2021_february.pdfIn PDF document text
    • https://cdn.sqhk.co/wekaradukuve/FLihnIV/peluxopowi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4ede270-29ef-432b-82f0-91bf92e8d0d7/cant_connect_denon_bluetooth.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8493fcc9-126e-464e-9110-434c6aa94dde/sudunuwa.pdfIn PDF document text
    • https://c6506652-bf5e-4f52-be36-03dbfaede22c.filesusr.com/ugd/f74919_71a38f579d304de8b8d9bf76d7711d26.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/078dcb74-ee78-4f2d-bfa0-26b1582f44e8/what_is_unity_definition.pdfIn PDF document text
    • https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_49db656bc5994250b654a9353f9666f0.pdf?index=trueIn PDF document text
    • https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_5f9f1f1b4e80493a9c5b1c954d03f9dc.pdf?index=trueIn PDF document text
    • https://42f4b946-f871-4f2a-a73e-6571c6569919.filesusr.com/ugd/e20521_c1e8ec60db274e39baf988ff5b5c0f4d.pdf?index=trueIn PDF document text
    • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_c5be845b5fbe4900ac99f883a2ad0ef2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF2D 5520 bytes
SHA-256: 2e557003f164740ae6d1dc9fae1493866fa705abdf1859e776893620dcc33fd1
font_01_sfnt_off0000e1cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1CF 10256 bytes
SHA-256: c9ef7c5a4395835439f7546f0738865b9fe10f231938c4f8d0d6dedc65f26ace

Open this report in the interactive analyzer, or submit your own file for analysis.