Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce76f58469ef375d…

MALICIOUS

PDF

82.7 KB Created: 2021-03-16 00:50:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12b7d188e7b40e1f5b42f55ec7e486b0 SHA-1: 32addbc15f8c141d9923c66df4ee45e2e834d463 SHA-256: ce76f58469ef375d0228cbc06ab6d550c9d5aa12d7d65898b30e92fdb82de1f8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high probability of malicious intent. It contains multiple embedded URLs, with the primary one being 'https://golowaki.ru/wix?keyword=detroit+city+directory+1890', suggesting a phishing or malware distribution lure. The presence of external URIs and the overall detection points towards a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=detroit+city+directory+1890
    • https://naxofezuwu.weebly.com/uploads/1/3/5/3/135396878/e9990ebd416b.pdf
    • http://moscowflowers.online/95937228717at451.pdf
    • http://fixmarker.fun/cod_mobile_controller_for_androidglpbd.pdf
    • http://letnesil.xyz/36946693860qn8dg.pdf
    • https://cdn-cms.f-static.net/uploads/4421466/normal_5fd67102e731a.pdf
    • http://sweetmeet.online/holland_lop_color_breeding_guideq2xy6.pdf
    • https://cdn-cms.f-static.net/uploads/4488842/normal_603f06338c0d7.pdf
    • https://static.s123-cdn-static.com/uploads/4491669/normal_5fc9bf43a7cb8.pdf
    • https://dagatofolake.weebly.com/uploads/1/3/0/8/130874029/3da5aba653cf0.pdf
    • http://prodson.fun/sitemig2ql5.pdf
    • https://sekilulijafos.weebly.com/uploads/1/3/1/4/131438177/fukijokulelaza_juxiw.pdf
    • https://cdn-cms.f-static.net/uploads/4471484/normal_601eed520470d.pdf
    • https://static.s123-cdn-static.com/uploads/4413735/normal_5fcf57ef0ef24.pdf
    • https://cdn-cms.f-static.net/uploads/4473642/normal_6019cc7f0e344.pdf
    • https://pufoxedoj.weebly.com/uploads/1/3/4/4/134438994/9239802.pdf
    • https://neloramobipetez.weebly.com/uploads/1/3/1/4/131407165/6458332.pdf
    • https://cdn-cms.f-static.net/uploads/4453889/normal_602ed4cc0962c.pdf
    • https://cdn-cms.f-static.net/uploads/4413454/normal_604af70e8479b.pdf
    • https://static.s123-cdn-static.com/uploads/4387590/normal_5fcddf685a7e1.pdf
    • https://cdn-cms.f-static.net/uploads/4388274/normal_600db40c59835.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/66608230-e483-4d79-a954-04316ceb443b/61330185830.pdf
    • https://uploads.strikinglycdn.com/files/a9fde085-ada7-4b7d-9634-25dcccbc67b1/spanish_classical_guitar_songs_to_learn.pdf
    • https://uploads.strikinglycdn.com/files/6ba532ab-c22d-49d5-af8f-d406e2300972/wezulaxotogodoremisun.pdf
    • https://uploads.strikinglycdn.com/files/c6795b43-d580-461d-93de-2ed0d6faa185/manual_settings_for_sunset_portrait_photography.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107aa.bin
36607df15df76bd044bf6e7af2e77691eea83191f7db2d4f57c5144a65ddfb69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107AA 5160 bytes
font_01_sfnt_off00011960.bin
7088e1e1aa8c1d7a94d420844f48d0ee158c03b879ee397064b88fa2b6620967		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11960 10552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.