Malicious PDF — malware analysis report

Static analysis result for SHA-256 3dacbcd9134ba477…

MALICIOUS

PDF

83.0 KB Created: 2021-03-24 18:02:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: a8268804da603247fc28626bb8d176d9 SHA-1: 2faeadfd96f94d7538dbd5c5890f2af5f9cfc096 SHA-256: 3dacbcd9134ba47706a8875c7e9b54874e142f6fac1569a6c93948b72b412e29
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URI pointing to 'https://golowaki.ru/wix?keyword=benthic+zone+facts', suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains keywords related to the URL, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=benthic+zone+facts PDF link annotation
    • http://zuvels.xyz/oak_island_money_pit_stone_tablet3lnfz.pdfIn PDF document text
    • http://wulurag.mygamesonline.org/contoh_general_cognitive_ability_test.pdfIn PDF document text
    • http://sugebowupubixo.mypressonline.com/74538823188.pdfIn PDF document text
    • http://wusodopepufex.66ghz.com/my_facetime_was_answered_on_another_device.pdfIn PDF document text
    • http://easybranding.org/wejuxim2ich.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://beruzamewog.epizy.com/tosuvofibopukadamojepol.pdfIn PDF document text
    • http://tobikinos.onlinewebshop.net/nalejadikerijuzoga.pdfIn PDF document text
    • http://xaligapuk.epizy.com/jirebadopap.pdfIn PDF document text
    • https://3f46bf15-0a8c-4e80-b3e5-a2e3bf90e008.filesusr.com/ugd/8e6e76_8ae4f298f89749239852d3a0c09e4a65.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vososasoxumete/9364809056.pdfIn PDF document text
    • https://52ed6390-a5c1-4502-9f93-599cf6d98ad1.filesusr.com/ugd/f7fbc8_fba4b32df74b44ab8577e7a2e79b3604.pdf?index=trueIn PDF document text
    • https://8c4778c4-ed17-4cf1-86f9-5448e21c5c15.filesusr.com/ugd/6da380_2d480aef40d040d29cf2f9b2b720a304.pdf?index=trueIn PDF document text
    • http://sipawas.epizy.com/wiwebedokogaz.pdfIn PDF document text
    • https://s3.amazonaws.com/fogibi/madovov.pdfIn PDF document text
    • https://54179944-c6a3-49b3-9462-5d1939b6aff2.filesusr.com/ugd/49f5ef_3af5f7341849415ca78ae78bec5e453e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wolina/5853484442.pdfIn PDF document text
    • https://s3.amazonaws.com/vudivuzakal/brother_sammy_adom_bi_audio.pdfIn PDF document text
    • https://s3.amazonaws.com/vovuzize/ximugizajijufosopo.pdfIn PDF document text
    • https://ab60d57a-1f92-408f-9079-0b325776b613.filesusr.com/ugd/724fb5_2ae5c3da26fc44efa9f427c00fc88833.pdf?index=trueIn PDF document text
    • http://mewaleb.rf.gd/zepirabigavodawolozi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC42 4728 bytes
SHA-256: 6a1d0b517e1d060db426115f70aa511b773857d9cffe65e2c3a904e0482586fa
font_01_sfnt_off00010c50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C50 10552 bytes
SHA-256: 978ee4d0daf7e4267e7616795e4e0ae4593822584729e38ff6d937c871dc01f6
font_02_sfnt_off0001304b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1304B 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.