Malicious PDF — malware analysis report

Static analysis result for SHA-256 4471c1868b070d5f…

MALICIOUS

PDF

91.3 KB Created: 2021-06-10 05:49:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 39ec97e502e37dc7d2ed71f990ca64b4 SHA-1: 7e33bb05207ea81f96be90aeac25e10d685e95d7 SHA-256: 4471c1868b070d5f329dd1550612797fbbcb9c6d530b40b2a538e172784720e5
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL pointing to 'garglob.ru', suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure related to electrical engineering topics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/pbw?utm_term=power+wiring+of+star+delta+starter
    • https://cdn-cms.f-static.net/uploads/4414336/normal_600f14a6c5ff2.pdf
    • https://cdn-cms.f-static.net/uploads/4475577/normal_60384c2a8c015.pdf
    • https://static.s123-cdn-static.com/uploads/4457318/normal_5fedf560282fa.pdf
    • https://cdn-cms.f-static.net/uploads/4461763/normal_60bf257e798bc.pdf
    • https://cdn-cms.f-static.net/uploads/4370268/normal_60597f313526e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wukexav.pbworks.com/w/file/fetch/144838347/in_which_western_european_country_did_the_industrial_revolution_began.pdf
    • https://uploads.strikinglycdn.com/files/469916db-fd66-45ab-b08e-aee93cbe1855/cryptography_and_network_security_by_william_stallings_6th_edition_solution_manual.pdf
    • http://misabovu.pbworks.com/w/file/fetch/144918234/bapudazamoturini.pdf
    • http://wasazejis.pbworks.com/w/file/fetch/144603417/is_there_an_accident_near_my_location.pdf
    • http://fesatisobif.pbworks.com/f/37662626195.pdf
    • http://garigor.pbworks.com/w/file/fetch/144425124/95684169747.pdf
    • http://zafasuvolo.pbworks.com/w/file/fetch/144544200/how_to_sync_veryfitpro_with_apple_health.pdf
    • https://uploads.strikinglycdn.com/files/d3414a71-2d27-48fb-ac7d-10a1f31997c3/buxavi.pdf
    • http://mizunebapod.pbworks.com/w/file/fetch/144799632/tolezodapotadabawi.pdf
    • https://uploads.strikinglycdn.com/files/185cc725-aa93-48ba-9764-e7bdebb80860/listado_de_verbos_en_ingles_con_pronunciacion.pdf
    • https://uploads.strikinglycdn.com/files/84b18bb1-0cfd-4ed9-8f04-46eedefb3e56/vehicle_identification_numbers_engine_code.pdf
    • http://zikasamu.pbworks.com/w/file/fetch/144709032/yellowstone_season_3_episode_10_characters.pdf
    • http://rerikisozid.pbworks.com/f/50346110953.pdf
    • http://nilanom.pbworks.com/f/919721890.pdf
    • https://uploads.strikinglycdn.com/files/6fef6fe6-2090-430f-af5b-7cf5eee0e965/partituras_para_banda_juvenil_gratis.pdf
    • http://dupalalo.pbworks.com/w/file/fetch/144728412/matokeo_kidato_cha_nne_2020.pdf
    • http://guronavageba.pbworks.com/f/how_to_do_a_home_budget_spreadsheet.pdf
    • http://rutarotovez.pbworks.com/w/file/fetch/144983937/dugosaredi.pdf
    • http://xugilip.pbworks.com/f/kitibupafiruxot.pdf
    • http://kepojijudiva.pbworks.com/w/file/fetch/144680025/dupabunijibi.pdf
    • http://febamizilaw.pbworks.com/f/13349917301.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001195f.bin
5cd9a43faae5665219584835575f027ac9c2d8eb482c28849feca3c3d6d4a890		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1195F 4956 bytes
font_01_sfnt_off00012a54.bin
8ed80b5635fde244ae062b6e0245e33f40b6558c90d8d63bd1acece61edcc87a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A54 11232 bytes
font_02_sfnt_off000150ad.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x150AD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.