Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9fa4479c85913be…

MALICIOUS

PDF

73.7 KB Created: 2021-03-16 02:23:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a5bf3331216a0a2a046a9e38416a38c6 SHA-1: 72d888701a8695a053b16c782a3526fbed6c00a2 SHA-256: b9fa4479c85913be447bc22732222d987188b546218494b525f3eab773363e18
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV and an ML classifier as malicious. It contains an embedded URI pointing to 'https://golowaki.ru/wix?keyword=benefits+of+damson', suggesting a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URI indicate a likely attempt to redirect the user to a malicious site, potentially for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=benefits+of+damson
    • http://copyrighytsupport.com/timex_nature_sounds_alarm_clock_instructions1jl8u.pdf
    • http://momentshop.website/jisewodedibeznzor5.pdf
    • http://constructionhouse.info/nexubobatepw5buu.pdf
    • http://degifutuv.scienceontheweb.net/koguzo.pdf
    • http://mufexamuxino.iblogger.org/63096324347.pdf
    • http://mugukix.mygamesonline.org/difference_between_thermal_cracking_and_catalytic_cracking.pdf
    • http://tk-pobeda.site/89089793259r8bqb.pdf
    • http://pitushok.space/notes_icon_png_freejvdym.pdf
    • http://dezunanerab.iblogger.org/dji_naza_lite_upgrade.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gofimegiwa.epizy.com/bejiwiwujabesevoki.pdf
    • https://e6a48395-9ebc-465e-8505-c4b20d7b8e72.filesusr.com/ugd/81e12b_ff8b0924fa3041f99f39405a1612392f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/16af8dca-dd82-4794-84fe-0b1030edfaf3/37986533564.pdf
    • http://sonowodiguvab.epizy.com/paranasal_sinuses_anatomy.pdf
    • https://uploads.strikinglycdn.com/files/8baf449b-ef44-436f-8bc9-2db0d6180d81/43182874002.pdf
    • http://mewugibi.rf.gd/shakespearean_sonnet_definition.pdf
    • http://genafivibin.rf.gd/cake_with_name_anniversary.pdf
    • https://77bac38d-831a-46d6-8f22-d7743fcadc58.filesusr.com/ugd/5b9a87_6cb276db5787478a8e2f4a19a81c0086.pdf?index=true
    • https://uploads.strikinglycdn.com/files/631a1711-0137-472e-bc2f-1b1a485970c9/barnett_rogue_crossbow_4x32_scope_package.pdf
    • http://likewiwojuxus.atwebpages.com/gate_2020_ece_question_paper_with_solution_made_easy.pdf
    • http://bevojekibawe.rf.gd/can_you_cook_cookies_on_a_pizzazz.pdf
    • https://c7f0abc7-d23b-482d-bd16-0771495bb668.filesusr.com/ugd/bb13a2_62cf103083464bbabe46f3bad2699bfe.pdf?index=true
    • http://zulegaxevo.epizy.com/sopowiwuvigifugu.pdf
    • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_815ca74b2fec4cd3818e927945f008f1.pdf?index=true
    • https://2791e1c6-719d-47aa-bdc5-1556df251b63.filesusr.com/ugd/7757c5_91798cda16fa4251b96726e6ff7c2085.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4f9.bin
64bd86147821ab369be4f658da511666934b27c1883f8509be1325109bdc5a1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4F9 4972 bytes
font_01_sfnt_off0000f5da.bin
ed7c3c0b3638177053bfbf1e39ba51296c31897ffa1b8a366d2cf838e27662c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5DA 10468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.