Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0d09f9b24715bb2…

MALICIOUS

PDF

74.3 KB Created: 2021-04-04 12:06:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78731f136206d1745995765c8b8a95ac SHA-1: 9520d1997472f4d9d2c107d2c15feaf53e97a923 SHA-256: d0d09f9b24715bb2de7420395068ed1e5cc34ae2355296215d14c5454490daab
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'golowaki.ru', which is likely used to deliver a malicious payload or conduct phishing. No scripts were extracted, but the presence of an external URI and the ML/ClamAV detections strongly suggest a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=paper+bunting+template+pdf
    • http://kejoxemubogese.mywebcommunity.org/basic_electrical_problems_and_solutions.pdf
    • http://kevifiregerufug.scienceontheweb.net/cycleops_fluid_2_turbo_trainer_price.pdf
    • http://beririka.scienceontheweb.net/4636254640.pdf
    • https://cdn.sqhk.co/bexefoboxevi/haWOgde/16766697348.pdf
    • https://cdn.sqhk.co/lenufetimop/gARhiib/18915430466.pdf
    • https://cdn.sqhk.co/loganidob/Qhf80gg/66422496847.pdf
    • https://cdn.sqhk.co/ramidazumiko/cgNhiGs/clovel_childcare_ryde.pdf
    • http://kutejovanog.getenjoyment.net/ketekivebimob.pdf
    • http://gomijojupi.iblogger.org/class_10_civics_chapter_7_answers.pdf
    • http://difozoxezepi.getenjoyment.net/rusedikazibeb.pdf
    • http://pifemukopisare.sportsontheweb.net/wubununoranigadebe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bivezekamolekaz.rf.gd/why_is_my_generator_not_making_power.pdf
    • http://rejizupufuxetib.rf.gd/srimad_bhagavatam_book.pdf
    • http://sosagid.epizy.com/angry_birds_transformers_mod_apk_obb.pdf
    • http://zusilovame.epizy.com/amlodipine_davis_drug_guide.pdf
    • https://469ee322-798e-4c1d-9571-af6764901f97.filesusr.com/ugd/57169b_937fd1a637a840c6bddaa66057873f95.pdf?index=true
    • http://gadivedu.rf.gd/spider_man_3_mobile_game_free.pdf
    • http://vavipok.epizy.com/zetoxe.pdf
    • http://ludekakub.epizy.com/michelle_beatles_piano_chords.pdf
    • http://rekekolulopar.rf.gd/word_power_made_easy_by_norman_lewis_latest_edition_free_download.pdf
    • https://c33c3ce4-fa2f-4f19-9477-7a801b41b29e.filesusr.com/ugd/ebbcbd_9d3bbf231696486ba5fe89c897d57e09.pdf?index=true
    • http://nivajunupoz.epizy.com/68180587801.pdf
    • http://laxukumelukadut.myartsonline.com/case_files_family_medicine_5th_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d819.bin
2c39abf22e5e8de6029947aaf7d82ed7c09ed293e3805b3d4d5cfd7313e00823		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD819 5096 bytes
font_01_sfnt_off0000e94b.bin
2038fab0c301e5d2ae21cbcbbf4ddf10b64a4dc7e858b946bcf928c2419987ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE94B 10640 bytes
font_02_sfnt_off00010dbb.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DBB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.