Malicious PDF — malware analysis report

Static analysis result for SHA-256 84bb1a431add91d0…

MALICIOUS

PDF

73.0 KB Created: 2021-04-04 14:18:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 0712d198e349af3cbf5d35d77d7696e2 SHA-1: ffc0069620a91874e8ad318b7ce53006b60e45bd SHA-256: 84bb1a431add91d08563132862a1ae52f93133e33fd62a326a0da785b56bde53
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The document contains a large number of external links, many of which point to PDF files, suggesting a link farm or redirection mechanism. The primary URL, 'https://golowaki.ru/wix?keyword=surface+area+of+a+triangular+prism+worksheet', indicates a lure related to educational content to draw users to a potentially malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=surface+area+of+a+triangular+prism+worksheet PDF link annotation
    • https://joguxakiwemov.weebly.com/uploads/1/3/4/7/134707067/19a4cad3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386365/normal_605998ee02204.pdfIn PDF document text
    • https://xozavefo.weebly.com/uploads/1/3/4/0/134018900/riresafak.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365570/normal_5fcb5de79b7ba.pdfIn PDF document text
    • https://vuvudosav.weebly.com/uploads/1/3/4/5/134579130/f39b17895f25.pdfIn PDF document text
    • http://givevexuwode.iblogger.org/what_did_the_four_freedoms_speech_do.pdfIn PDF document text
    • https://wipibafupegivu.weebly.com/uploads/1/3/4/8/134868488/tatumipu_vifateru_gipup_vobotapirumomex.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a2a8837-43e8-4535-a461-43354ea788bf/dozuvufuwa.pdfIn PDF document text
    • http://vufagozujidivu.epizy.com/zozofezunifuxirane.pdfIn PDF document text
    • https://s3.amazonaws.com/bulikowexunepov/bsmrmu_admission_circular_2018-_19.pdfIn PDF document text
    • https://s3.amazonaws.com/mexavofezoxi/photoshop_psd_designs_free.pdfIn PDF document text
    • https://s3.amazonaws.com/nunakixuma/jasidonevodapebalo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3ceb9d1-1cad-4d01-b29e-6bbcb8f9a59d/zapesokakapifedujip.pdfIn PDF document text
    • http://xerikosepekev.epizy.com/axinterop._acropdflib._dll_64_bit_download.pdfIn PDF document text
    • http://muropep.epizy.com/evga_gtx_970_ftw_specs.pdfIn PDF document text
    • http://lobunuwofapow.rf.gd/33347242153.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f74f701-dc5a-442f-aa78-5b6e09994590/nuwesudokupi.pdfIn PDF document text
    • https://s3.amazonaws.com/lanaladu/59461346615.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/rrb_ntpc_online_form_sarkari_result.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05d334e6-7224-40fe-a4b6-3e8873bfd4b2/royal_500_cash_register_manual.pdfIn PDF document text
    • http://zejajedep.rf.gd/flysky_gt3b_lipo_conversion.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dec1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEC1 5688 bytes
SHA-256: 21551557ea8acd2167977b5b2ca87f10a8e261c387381d3c6e61645899bf9a56
font_01_sfnt_off0000f202.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF202 10756 bytes
SHA-256: d658563c84d12b6220f6b26e63008917f2d0a0368e3a055e22b71c2359f1dd95

Open this report in the interactive analyzer, or submit your own file for analysis.