Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb0c12b110a11742…

MALICIOUS

PDF

75.6 KB Created: 2021-03-16 03:58:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87a3f9d7b5af5738f9752ab379a66253 SHA-1: d10d28c922e7a4ab8551985b251dbcb7f18cd22a SHA-256: bb0c12b110a117425d9b4415aa05059c824a7f55b6ad9078caf5c0fe54ded99c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'golowaki.ru', which is likely a malicious domain used to host or redirect to further malicious content. The document body, though heavily obfuscated, suggests a lure related to educational worksheets, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=balancing+equations+worksheet+1
    • https://cdn-cms.f-static.net/uploads/4370076/normal_6034d1091c64e.pdf
    • https://static.s123-cdn-static.com/uploads/4401972/normal_6000ad1f5545c.pdf
    • http://kapovulup.mywebcommunity.org/what_is_the_slanted_tip_of_a_needle_called.pdf
    • https://static.s123-cdn-static.com/uploads/4527108/normal_5ffd4dd0696df.pdf
    • http://myluckywin.site/neruda_100_love_sonnetsx7lyn.pdf
    • https://cdn-cms.f-static.net/uploads/4367911/normal_6046350acb109.pdf
    • http://filozajerezabi.getenjoyment.net/xazetobex.pdf
    • http://hq-cleartv.info/how_to_find_trig_values_of_anglesy1i4w.pdf
    • http://f1l3download.site/mr_heater_big_maxx_code_3dnc75.pdf
    • http://sosogemizibu.mypressonline.com/57902093111.pdf
    • https://cdn-cms.f-static.net/uploads/4490516/normal_6012f1a6dc658.pdf
    • https://static.s123-cdn-static.com/uploads/4481065/normal_5fc8b0f6af9a8.pdf
    • https://cdn-cms.f-static.net/uploads/4383792/normal_602f5eb67c2eb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/forupokisip/xuxudumanoxipizub.pdf
    • http://fabevax.myartsonline.com/cfa_level_1_curriculum_2020_download.pdf
    • https://6f12065f-c45d-410c-b048-6ec23fb2b810.filesusr.com/ugd/02ccf7_aa06b3d10e754b889046d5fde8135776.pdf?index=true
    • https://eb40363d-1d1f-4170-a897-f23f0f433116.filesusr.com/ugd/2a1429_f5c8ba313a1a4053bd0d156ae99236dd.pdf?index=true
    • https://s3.amazonaws.com/kaxukok/11868224405.pdf
    • https://s3.amazonaws.com/sepovutapakogaf/ignition_scada_manual.pdf
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_87657bb571f04ce084653a7d0e4aeeb4.pdf?index=true
    • https://729282ec-1290-4cbc-9302-cf8a24acd4c7.filesusr.com/ugd/42c189_9facb02e2d084adda618f0b89c4aaa45.pdf?index=true
    • https://s3.amazonaws.com/farefasejikap/d_d_5e_rogue_multiclass_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e980.bin
e25723012611b488c57007a915d369f729436ca1da5046795fb690cd64ceafa2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE980 5444 bytes
font_01_sfnt_off0000fc14.bin
e9988f9cfcd1134b7810933444fa08372067f2aab852b343eff718dec82484d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC14 10780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.