Malicious PDF — malware analysis report

Static analysis result for SHA-256 5212e2103870cbc5…

MALICIOUS

PDF

88.8 KB Created: 2021-03-13 19:59:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b057f232ac60e911c3e1bd6badc31d0c SHA-1: b02a82f5d854b84e08bda620b6cfb16ad654cc77 SHA-256: 5212e2103870cbc519c132dcb86cecbab9760050e342575b9558f2b18bc647df
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URIs, including one pointing to 'golowaki.ru', suggesting it acts as a lure for potentially unwanted software downloads. The presence of a 'download button' heuristic further supports the phishing or scam-like nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=showbox+apk+app+for+android+tablet
    • http://pugezesiw.mygamesonline.org/fepabulisika.pdf
    • https://cdn-cms.f-static.net/uploads/4446496/normal_6028e7bbb2499.pdf
    • https://static.s123-cdn-static.com/uploads/4500001/normal_5ff344ae94d87.pdf
    • https://cdn.sqhk.co/duwewofowus/RP1FAtk/pixel_force_2._4._4_mod_apk.pdf
    • https://static.s123-cdn-static.com/uploads/4387243/normal_60064f5200c5c.pdf
    • https://betamomaj.weebly.com/uploads/1/3/2/6/132695924/e25bacd874b3d.pdf
    • https://cdn-cms.f-static.net/uploads/4426066/normal_602f7ef310951.pdf
    • https://cdn.sqhk.co/kotafuli/cuREm7a/wujagu.pdf
    • https://zaniwobomivefo.weebly.com/uploads/1/3/1/4/131406480/3ab7aa331b1cd9.pdf
    • https://cdn-cms.f-static.net/uploads/4462362/normal_5fe90a3f6a2a6.pdf
    • https://cdn.sqhk.co/zujubiviv/VzheuYj/tanuburumer.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1794ee33-230d-455b-98b1-84d48067edce.filesusr.com/ugd/551769_365fff8767c24cd294bf1ad098e5a285.pdf?index=true
    • http://sazasewugekupej.onlinewebshop.net/93967037824.pdf
    • https://uploads.strikinglycdn.com/files/7a4f0999-90bf-44f5-97e1-9d09f2e1aba6/88567039067.pdf
    • http://feferabi.atwebpages.com/craigslist_dayton_auto_parts_for_sale.pdf
    • https://6f29901e-f5c9-4775-879c-97b2de5c8d5b.filesusr.com/ugd/0bf195_59c94db97e894341945e35f5e91fc5af.pdf?index=true
    • https://e06e8306-d71e-4c92-aa1b-e8c52eeb44cb.filesusr.com/ugd/bc4951_17762285987f41b4be4fa8741768d1dd.pdf?index=true
    • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_bddfce4f1917446e826aabeb27d72437.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3fcf7517-3147-4ee3-9ec6-668be34d721b/tikokadasuxenijix.pdf
    • https://4b3b4da4-1145-40fd-8a04-0ac29766dab0.filesusr.com/ugd/6c6203_e23db732432248f3a887364577fac1ac.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c94.bin
5b286c3d86b0459cb5857b37187c96684e7b598209d099425e9d8497b239e8c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C94 5416 bytes
font_01_sfnt_off00012f0e.bin
caeff2dd0884085598a3b69cb2be1e8e65c52668b8c837df936e2901a5de5c1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F0E 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.