Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8c04233c5808659…

MALICIOUS

PDF

68.8 KB Created: 2021-05-15 05:36:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4e8088cfee8d348035d1ded107ed5d68 SHA-1: 24caa93ed97beefbaffa764ca5999f6664e6703d SHA-256: a8c04233c5808659f01f71b06820f78b5bb88096c50a660728b3750f86da7e84
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF link farm' designed for SEO manipulation. The embedded URL 'https://golowaki.ru/strik?utm_term=part+5+common+core+practice+answers+grade+6' suggests a lure related to educational materials. ClamAV detection and ML classification strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=part+5+common+core+practice+answers+grade+6
    • https://naxibozagut.weebly.com/uploads/1/3/4/5/134580084/depuviti_garifamipo_mibudeweviwosif_xovojerijav.pdf
    • https://xagapetudiza.weebly.com/uploads/1/3/4/6/134686513/wovetagebukamexola.pdf
    • https://ladupizisegi.weebly.com/uploads/1/3/1/3/131380895/5443531.pdf
    • https://femomupine.weebly.com/uploads/1/3/4/4/134458898/2e3c89b3e945c.pdf
    • http://beamorem.com/muvunesikw8xvv.pdf
    • https://fumewalifo.weebly.com/uploads/1/3/4/8/134884483/9736309.pdf
    • http://astrology-personal.online/dream_yuga_price_in_rajkot5kj0h.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_01fda06878204a04831b83b79de3b319.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d292af3e-d7e0-4e6e-8066-e2536b650089/robonawagoximaleve.pdf
    • https://uploads.strikinglycdn.com/files/4debd812-d29c-427e-878a-258719b07cd4/how_to_clean_a_browning_bps.pdf
    • https://40ba1f7a-6e91-49bb-bbb8-dfbb40a2bc60.filesusr.com/ugd/22bf55_5dc6cb50937f4c04b575805066c84d96.pdf?index=true
    • https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_29731236009a469b8952077d008214c6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7ffa5540-deec-4aea-81e4-773d3752aae2/swtor_synthweaving_guide_700.pdf
    • https://uploads.strikinglycdn.com/files/14d92080-126b-44ef-baf6-42e965b7c619/69524481615.pdf
    • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_ec0996f6c190464b8fd815a2ad51875c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/18b46703-acaa-4cdc-98d2-492984683c95/how_many_calories_in_flatbread_subway.pdf
    • https://a765b249-d442-4b07-8ea9-8318d996b894.filesusr.com/ugd/902d29_59e876f9ad364f1cafdb5ad1c3b33afe.pdf?index=true
    • https://2ed9768e-82a7-41f7-bc91-4b86d8d7aa0f.filesusr.com/ugd/bdbd91_f0c63cb4035b4d65a9fe5fdcdf199f19.pdf?index=true
    • https://8d94caac-80d5-4f6d-a73a-04ed47837dc1.filesusr.com/ugd/585b1d_fcdef0b09360490a83f1f6d54918523e.pdf?index=true
    • https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_a31293d99eea458584866be056867378.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd2c.bin
7b4ac8dc15ce25667be29e47b5dc94ad570c4736c077c17a4552e1237d768c00		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD2C 5732 bytes
font_01_sfnt_off0000e0ad.bin
a7ecd5fa2c88e9c6918322dabb59c50f950be3ccd90061646d63db7401c43d57		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0AD 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.