Malicious PDF — malware analysis report

Static analysis result for SHA-256 684b8f8fd3efe9a9…

MALICIOUS

PDF

71.6 KB Created: 2021-03-15 02:43:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 939a12ee50012ac1c6b81de33811386b SHA-1: 1c3bf3083defe0b5443985bd7def5c92f790316e SHA-256: 684b8f8fd3efe9a9af0dc58a4c797dbb10f6848cca5abe3c5401d0f1413bdd13
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'golowaki.ru', which is likely a phishing or malware distribution site. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to redirect users to a potentially harmful external resource, possibly for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=adding+subtracting+algebraic+fractions+worksheet
    • http://zutolewe.mywebcommunity.org/miluge.pdf
    • http://rasezatoxefu.mygamesonline.org/samsung_range_display_problems.pdf
    • http://modarab.mygamesonline.org/diabetes_alloxan.pdf
    • http://jadogaxarabu.mygamesonline.org/kuvokobiwireb.pdf
    • http://rozogididibusar.sportsontheweb.net/the_elements_of_statistical_learning.pdf
    • http://wusokamojifel.scienceontheweb.net/the_martian_movie_download_tamilrockers.gr.pdf
    • http://mikovil.mywebcommunity.org/dunkin_donuts_wake_up_wrap_turkey_sausage_calories.pdf
    • http://mavigawika.scienceontheweb.net/12046144017.pdf
    • http://berasowugixo.mywebcommunity.org/tosogumuzikij.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://baxewape.myartsonline.com/how_to_start_a_theme_essay.pdf
    • https://uploads.strikinglycdn.com/files/60347913-e605-4528-bb84-d2dc02fa087e/what_is_the_concept_of_nuclear_deterrence.pdf
    • https://uploads.strikinglycdn.com/files/4d775297-8edc-4093-a3fe-c7e35b177296/why_is_my_fitbit_versa_lite_screen_black.pdf
    • https://uploads.strikinglycdn.com/files/5b41b4b9-6b0b-42d0-b67a-08c93b031e60/xajikuveg.pdf
    • http://liduvitulugug.onlinewebshop.net/how_tall_is_neil_degrasse_tyson.pdf
    • https://s3.amazonaws.com/jenagubadopi/english_to_chinese_mandarin_dictionary_free.pdf
    • https://s3.amazonaws.com/mizeteb/whirlpool_dishwasher_adp_755_user_guide.pdf
    • https://s3.amazonaws.com/wutisigila/how_to_heal_popped_cystic_acne.pdf
    • https://uploads.strikinglycdn.com/files/5e8ba57f-b990-467f-b2cb-726ca40d2455/72021045497.pdf
    • https://s3.amazonaws.com/fujadabez/84772214336.pdf
    • http://dijuvunote.onlinewebshop.net/tony_evans_bible_commentary_walmart.pdf
    • https://uploads.strikinglycdn.com/files/b58dbf10-2dfa-4d85-a21d-1e6a0796e0ea/mudotugomerowome.pdf
    • https://s3.amazonaws.com/kelageketisefuv/94896903088.pdf
    • https://uploads.strikinglycdn.com/files/d20decaa-9ea3-47a8-ba10-40fb2c6c1854/are_aisi_and_sae_the_same.pdf
    • https://uploads.strikinglycdn.com/files/fca497cb-97c6-4ba9-9a85-0fdea2c864af/the_boy_in_the_striped_pajamas_book_character_descriptions.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd9d.bin
b2a1e67436ca921719271564ec401e8f8a8e583b3089fa41df0a9ec814e60788		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD9D 5448 bytes
font_01_sfnt_off0000e024.bin
110b64882f1f6eab2bddf20440a9096580fe19571dd438112df8811655446807		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE024 9524 bytes
font_02_sfnt_off000100bb.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100BB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.