Malicious PDF — malware analysis report

Static analysis result for SHA-256 78361555c80b84db…

MALICIOUS

PDF

74.5 KB Created: 2021-03-15 00:51:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4db87a13d6567a77fe350dfeb735ffed SHA-1: 55d08a1f65e32535b4caf750411f8c34d9121ab3 SHA-256: 78361555c80b84db30cbff290ceae92df3c8d8b86426669ca41de9d1de0f990b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'golowaki.ru', which is likely the primary distribution point for the malicious payload. The document body, though heavily obfuscated, suggests a lure related to educational content ('Variation worksheet ks3'). No scripts were extracted, but the presence of external URLs and the malware detection strongly indicate a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=variation+worksheet+ks3
    • http://serdyukov.pro/nuvision_10.1_windows_tabletgjset.pdf
    • http://tameeniraq.com/66357792166sjuk9.pdf
    • http://zoomita.fun/ates_ve_su_3_kisilik_oyunu_oynaq9pmg.pdf
    • http://m-laskin.ru/what_is_the_meaning_of_logical_thinkingg6fdy.pdf
    • https://cdn.sqhk.co/rijatazuga/cnhghaQ/rapodosajumut.pdf
    • https://cdn.sqhk.co/xetilibul/M1ijici/3032251346.pdf
    • http://7lessons.site/resulagu8rqm.pdf
    • https://cdn.sqhk.co/nowavutu/hjieNIN/medulaguterokubo.pdf
    • https://cdn.sqhk.co/nomuzali/AFmYicP/xinapivarugojikagepakowuz.pdf
    • https://cdn.sqhk.co/julukijowi/fmhdwyI/cnc_machine_shop_for_sale.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_6dff88ec3191456ab0ad86750ecd1ccb.pdf?index=true
    • https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_21ff18541af94dee8868c43ac92cb9b2.pdf?index=true
    • https://s3.amazonaws.com/wovugi/vofazes.pdf
    • http://xigufogadenake.epizy.com/80843436760.pdf
    • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_40c786a020cb49e8900a56901f555022.pdf?index=true
    • https://s3.amazonaws.com/fosalizuzu/39611441872.pdf
    • http://lojogonofar.rf.gd/mailing_label_template_for_apple_pages.pdf
    • https://b3dfd9c9-1030-471f-a26d-814ea73dbccc.filesusr.com/ugd/d97afa_c89d37239b204687a52debdd150dc9f4.pdf?index=true
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_632f1b89d5c44038bda97c77b11ccaf2.pdf?index=true
    • http://nabikelotedabe.epizy.com/piano_music_sheets_with_notes.pdf
    • http://rawarawoxegig.epizy.com/jikira.pdf
    • http://zafuriket.rf.gd/integers_and_rational_numbers_worksheet.pdf
    • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_d7480b7f8c8444e3ad7acf9c14a73244.pdf?index=true
    • https://dca540c6-954d-4243-9f09-0921753db957.filesusr.com/ugd/974a4e_f2591f3684494cc6bfc69e116fc9dbee.pdf?index=true
    • https://s3.amazonaws.com/geraromu/challenger_school_uniform.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da3b.bin
255d63fd327262b2f3a0c44f26f150fd5001994dddbb335e7fd0be1144506b80		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA3B 4812 bytes
font_01_sfnt_off0000ea96.bin
e352d883a1ae1d71c9b27a5492711c8650eb3ec266d554386b30cfd7101e2a0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA96 10316 bytes
font_02_sfnt_off00010df5.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DF5 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.