Malicious PDF — malware analysis report

Static analysis result for SHA-256 733aff44b5ebec0a…

MALICIOUS

PDF

100.0 KB Created: 2021-03-18 08:42:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 98ce90d9cb5bbb460d3d20749f502e28 SHA-1: 4e7cf224e5099acf98d119a0c86906751267a627 SHA-256: 733aff44b5ebec0a1a2c16a26da8ac0319a4831bd16a910172bcb40ddc8b73d1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'golowaki.ru', which is likely a malicious domain used to host phishing content or deliver further malware. The document body, though heavily obfuscated, appears to be a lure related to product specifications, aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=sony+bravia+kdl-32l5000+specs
    • http://xutefizil.getenjoyment.net/1227138612.pdf
    • http://witikotuxigere.scienceontheweb.net/rt-ac68p_reset_login.pdf
    • http://fuvesozufinefi.medianewsonline.com/36494734065.pdf
    • http://nitiwomifigurod.mygamesonline.org/6845491940.pdf
    • http://zonerokemub.getenjoyment.net/ponamozapavo.pdf
    • http://pixunune.sportsontheweb.net/81241714865.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7b59c87d-961f-47f8-aeaf-6d8d5b1db364/best_strength_training_anatomy_book.pdf
    • https://uploads.strikinglycdn.com/files/6e6cf3e2-a430-44a0-99c5-571818027c21/vopumasigikowesulaped.pdf
    • https://uploads.strikinglycdn.com/files/034cafa3-7677-487a-83df-78b16a886bf0/instep_bike_trailer_coupler_walmart.pdf
    • https://uploads.strikinglycdn.com/files/94b44198-1f1f-4f5b-9b5d-b93d9684f2a2/kelelofefofubi.pdf
    • https://uploads.strikinglycdn.com/files/6e971c85-ea4e-4ba3-b422-574be2aa08b8/do_disney_employees_get_free_parking.pdf
    • https://uploads.strikinglycdn.com/files/cce33c4f-79f6-427e-b6bd-15f2ba3ae860/tales_of_demons_and_gods_manga_indo.pdf
    • https://uploads.strikinglycdn.com/files/25cb1209-db9e-4d5e-b712-060ff9a02092/what_can_i_name_my_black_cat.pdf
    • https://uploads.strikinglycdn.com/files/800e7cbe-cbde-4f53-8948-a22e5c7884a7/who_was_leader_before_kim_il_sung.pdf
    • https://s3.amazonaws.com/limewub/linux_centos_6._9_iso.pdf
    • https://uploads.strikinglycdn.com/files/9352c068-64e2-4efc-9425-e622d743c3bd/padi_advanced_open_water_diver_manual_answers.pdf
    • http://sajoveguduv.onlinewebshop.net/buku_akuntansi_biaya_baldric_siregar.pdf
    • https://s3.amazonaws.com/wenobagupexekap/xexalalelumezewusevigibon.pdf
    • https://uploads.strikinglycdn.com/files/4d48a727-c3ab-4a9b-b1ff-2d2f9afe547f/1995_polaris_xplorer_400_specs.pdf
    • https://s3.amazonaws.com/fadobirak/graphic_design_app.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001485f.bin
cecc6928803e8faf8b07904486fc36c4361fbf8590c4b3c8661cf67811b1fdd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1485F 6132 bytes
font_01_sfnt_off00015d5b.bin
fa6a0ba88b30b109eceb2eb4ea470477e1bbe33b3271d3d62d18de507b98681b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15D5B 11008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.