Malicious PDF — malware analysis report

Static analysis result for SHA-256 a39df7b3c45de6af…

MALICIOUS

PDF

91.3 KB Created: 2021-03-15 09:21:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a7e1bec90b5b95de72cfa524ad3d8504 SHA-1: 70650231208681ce40158075cfddac0a76357f05 SHA-256: a39df7b3c45de6af163e8be363b264154a6bb5ef93a6f31f79fdb16a6517bf88
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'https://golowaki.ru/award?keyword=assessment+methods+in+teaching+and+learning+pdf', suggesting a phishing or credential harvesting attempt disguised as a document. The document body, though heavily obfuscated, contains keywords related to the URI, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=assessment+methods+in+teaching+and+learning+pdf
    • http://misovar.22web.org/alfreds_piano_methode_voor_volwassen_beginners_1_cd.pdf
    • http://aycotoro6.xyz/sopidetogagagoiqms5.pdf
    • http://lisifakus.66ghz.com/20587313846.pdf
    • https://cdn-cms.f-static.net/uploads/4416132/normal_602c46fa15066.pdf
    • https://cdn-cms.f-static.net/uploads/4490266/normal_6045f9a5c3f2a.pdf
    • https://cdn-cms.f-static.net/uploads/4416500/normal_604b68d2528c9.pdf
    • https://cdn-cms.f-static.net/uploads/4393485/normal_601bdf83e5b96.pdf
    • http://sidumila.iblogger.org/62063373645.pdf
    • http://capridigi.com/87304472309hay5o.pdf
    • http://dwatches.site/95104841684bskc3.pdf
    • https://static.s123-cdn-static.com/uploads/4454990/normal_5fcf2e17c1043.pdf
    • http://br1.red/this_modern_love_ukulele_chordsixbwv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bodalize.epizy.com/28601483703.pdf
    • http://vamavom.epizy.com/sennheiser_rs_175_review_uk.pdf
    • https://s3.amazonaws.com/tosevud/colorado_2018_election_voter_guide.pdf
    • https://uploads.strikinglycdn.com/files/5af8cb8e-a599-4a66-a2de-cd1721d19b5e/dixuraloxilu.pdf
    • https://uploads.strikinglycdn.com/files/e3ab9bd6-1320-4de5-8ab4-5765b01504ff/4520486212.pdf
    • https://s3.amazonaws.com/tunenijexe/cricut_printable_vinyl_sheets.pdf
    • https://uploads.strikinglycdn.com/files/7092a22d-a270-4065-b570-e4193abc0302/zebagepixon.pdf
    • https://s3.amazonaws.com/runuzitexokol/8376503929.pdf
    • https://uploads.strikinglycdn.com/files/e4052565-4bdb-4334-a658-f3c55d2875f5/how_to_replace_a_fuse_on_a_furnace.pdf
    • https://uploads.strikinglycdn.com/files/e64063e6-fa9b-45ea-8bfd-2246bbacc751/40837933809.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001191b.bin
aa115f9de1d593b3d81b91dbebb62804bbc59614a0877a101fe1a87a6a04e406		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1191B 5344 bytes
font_01_sfnt_off00012b0e.bin
3c7e2d1c03d44d849da7f5bd5f8db62e2152b58e4da9a3dffa65749a404c6608		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B0E 11120 bytes
font_02_sfnt_off000150df.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x150DF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.