Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8fae649d0d204f8…

MALICIOUS

PDF

76.2 KB Created: 2021-03-27 21:43:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 71d07f76fde91ba3660f0e8142a95c01 SHA-1: 03147a8a38dc91b03fdac668064a5a924a9b169b SHA-256: d8fae649d0d204f81caed6bc9bf7fa73b67aa33ef37d4e3abf32ce3f352819db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'https://golowaki.ru/wix?keyword=anime+symbols+naruto', suggesting a phishing or malware distribution attempt. The document body is heavily obfuscated, but the presence of external URIs and the overall detection indicate a malicious intent to redirect the user to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=anime+symbols+naruto PDF link annotation
    • http://bopolubolef.mywebcommunity.org/how_to_use_baby_bjorn_mini.pdfIn PDF document text
    • http://paypallsecurity.com/how_to_obtain_enhanced_drivers_licensej12ij.pdfIn PDF document text
    • http://copyrightsupportforlnstagram.com/fivage253gy.pdfIn PDF document text
    • http://letinebab.mywebcommunity.org/vetuwuper.pdfIn PDF document text
    • http://idealslim-italiaofficial.site/fevogolepobanakisufbln2.pdfIn PDF document text
    • http://tuimag.ru/is_boston_market_turkey_realf802c.pdfIn PDF document text
    • http://japancar-sib.ru/limabedepiku1pvf4.pdfIn PDF document text
    • http://vezerfa.xyz/texas_instrument_ti-30x_solariys18.pdfIn PDF document text
    • http://tublitalia.fun/where_can_i_get_my_rabbit_neutered_for_freemckm6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/goneduzum/lamborghini_full_song_video.pdfIn PDF document text
    • https://s3.amazonaws.com/gixirojozogufux/patopepidejefoge.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ed80334-d80f-4ede-9047-972899df312e/graphic_design_portfolio_or_website.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8da90ae0-985a-4ff8-af86-db4f6e049319/fisher_paykel_dishwasher_repair_f1.pdfIn PDF document text
    • https://88749095-6fd7-453f-8e8a-15b48fe47dd1.filesusr.com/ugd/e4d7df_ce70790805ff44b6bed0544b2fc19657.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gifiz/98427256779.pdfIn PDF document text
    • https://s3.amazonaws.com/mavixu/sudotapedi.pdfIn PDF document text
    • http://vawerudarasikow.myartsonline.com/what_is_the_starting_salary_for_an_international_business_major.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/581676ea-9049-44c2-a389-2b375d8fb938/jujolomujivipuvajitupas.pdfIn PDF document text
    • http://wiwosotu.myartsonline.com/turukenopudewa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3515891-c862-48ae-b767-2a21e92fa9a3/nutribullet_immune_system_recipes.pdfIn PDF document text
    • http://gevapugono.atwebpages.com/gulogovekiwofedolodef.pdfIn PDF document text
    • https://1b3fde16-7575-45ba-b40e-8916c64185ca.filesusr.com/ugd/8874e8_ef7d440924414ca9bb96f4025a11f55c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zunewidimem/pasipesunabepajoma.pdfIn PDF document text
    • https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_9b0f0ee760b740b0976fb6fffac977e9.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE0A 5060 bytes
SHA-256: 3bf303cbe25079b2666e0120599a2466b5916a4a3a957e5fed073603af8b026b
font_01_sfnt_off0000ff2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF2F 10664 bytes
SHA-256: 9c073828d6308c2a85f5e5b9be21a877777910aafd1e54ac4ab43ab360723466

Open this report in the interactive analyzer, or submit your own file for analysis.