Malicious PDF — malware analysis report

Static analysis result for SHA-256 6414e0c0d314d3c9…

MALICIOUS

PDF

78.1 KB Created: 2021-03-08 16:57:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b8d432208914f43cbc1a0858bfb68b1 SHA-1: 193929229daaee47c3bbb326db57bcdfde9f06ec SHA-256: 6414e0c0d314d3c9951e2af078b86468d0bab439a55bc85592208f644faa60ab
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded links, one of which points to a suspicious domain (golowaki.ru) with a lure related to a "mobile location check app". The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external links, suggesting a phishing or spamming operation. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious classification. While no scripts were explicitly extracted, the nature of the links and the detection suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=mobile+location+check+app
    • http://souve.me/25402346078a6w3r.pdf
    • http://fomilexavekol.22web.org/chinese_english_dictionary_offline_free.pdf
    • http://neo-tp.ru/84210739854kbtvd.pdf
    • https://povilaromegew.weebly.com/uploads/1/3/4/4/134486615/743b1e.pdf
    • http://businesshelpservice.com/mibaretagejimetiledenunj47r.pdf
    • https://roxewakedenal.weebly.com/uploads/1/3/1/4/131483042/4338293.pdf
    • http://avto-trokot.xyz/1215569256qjmag.pdf
    • http://tanirexelobixo.iblogger.org/unscramble_sentences_worksheets_free.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://joposib.rf.gd/xoxopopekikuxizekenifos.pdf
    • https://uploads.strikinglycdn.com/files/a52a9288-58ae-48fc-84bd-562dac2ed8b7/32250828736.pdf
    • https://uploads.strikinglycdn.com/files/f2993d61-ef17-40f6-aa17-2de26a9d2e96/tekitasumokak.pdf
    • https://uploads.strikinglycdn.com/files/a93d62d5-7786-4a2e-80b0-940ea024dad0/eragon_inheritance_ending.pdf
    • https://uploads.strikinglycdn.com/files/5c5b9728-ebcf-4951-abdc-4526b1ed0b84/33327935052.pdf
    • https://uploads.strikinglycdn.com/files/68903126-3c51-4674-aa71-a9254a3133ef/are_resistance_bands_good_for_seniors.pdf
    • http://bawanakoj.epizy.com/sobapel.pdf
    • http://newiroxupamorik.rf.gd/free_border_word_template_design.pdf
    • https://uploads.strikinglycdn.com/files/79f88bba-0726-4c9c-9203-398e3957ab3b/honeywell_4219_datasheet.pdf
    • https://uploads.strikinglycdn.com/files/be361a21-81b3-4345-9d07-b19e7ff52fc1/how_to_draw_a_autumn_tree.pdf
    • https://uploads.strikinglycdn.com/files/6b7851d2-fa0b-4fba-92b5-cf86ea4e2a42/21035132598.pdf
    • http://zozafiromilofin.epizy.com/coreldraw_portable_google_drive.pdf
    • https://uploads.strikinglycdn.com/files/1ce136ab-e2f1-4570-ab8b-edd9840d0909/excelsior_college_tuition_assistance.pdf
    • http://masifegudogona.rf.gd/android_toolbar_elevation_pre_lollipop.pdf
    • https://uploads.strikinglycdn.com/files/834e514b-8ab8-4271-b63d-e625af6a0871/99845130229.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f425.bin
ff7f0871b2ac96692da87f3bfd21c7c9d4e6a3f52ad7b2db26c5dd502c0011ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF425 4956 bytes
font_01_sfnt_off0001050d.bin
c78c4f23f710432791df9577e5b73c7102ffee20776fdbedb94e0f1a856facfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1050D 11092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.