Malicious PDF — malware analysis report

Static analysis result for SHA-256 e346c4a4520fe75e…

MALICIOUS

PDF

92.3 KB Created: 2021-04-09 16:44:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1b195309a8e8d0fe43a1696982093030 SHA-1: e86ff9353e48da044beca4fba45908b6f6c870c6 SHA-256: e346c4a4520fe75ed105a370a129170e0410f445d13f1ff691f53399f9d0888b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for PDF_MALICIOUS. An external URI pointing to 'golowaki.ru' was extracted, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'Oracle sql expert certification cost', likely a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=oracle+sql+expert+certification+cost
    • http://nafarami.medianewsonline.com/alcoholism_introduction.pdf
    • http://didazema.mypressonline.com/66910196780.pdf
    • http://nipawifaxupus.mygamesonline.org/what_are_the_main_features_of_realism.pdf
    • http://ooovseanalizi.ru/what_is_primary_nursing_care_delivery_model79fw3.pdf
    • http://megopoveguvujal.medianewsonline.com/tetavadimif.pdf
    • http://bigops.fun/20448981253e3q86.pdf
    • http://vidclips.design/practice_research_methods_psychology_tests3c58k.pdf
    • http://calipshatngaccs1.xyz/gotudozajisetetmhu9.pdf
    • http://filmera.ru/dream_house_days_jobs_guidev5hoc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vujuvisesakok.myartsonline.com/rewigima.pdf
    • http://zitasixan.atwebpages.com/shadowrun_renraku_arcology_shutdown.pdf
    • https://s3.amazonaws.com/vezumobigodub/california_critical_thinking_skills_test_answers.pdf
    • https://s3.amazonaws.com/kuboki/baba_is_you_igg.pdf
    • https://828c6a01-da61-4814-986a-f72e64f4f334.filesusr.com/ugd/cdfdba_ecadd8cde87e4f1788b3d0ceb9019828.pdf?index=true
    • https://40052bae-d6b0-4be3-9c84-96956a804c69.filesusr.com/ugd/32907c_1b71ce91e4db459380bccd381fa7cae6.pdf?index=true
    • https://s3.amazonaws.com/ruzumeb/64995923202.pdf
    • https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_3ccf5fcb223d4ef885ed763c35d3fd87.pdf?index=true
    • https://s3.amazonaws.com/miledu/fukobabenoxeniruneka.pdf
    • https://s3.amazonaws.com/xifabilejilab/surf_excel_advertisement_video_free.pdf
    • https://0df6220b-9630-4647-aab6-0d9db69b9d59.filesusr.com/ugd/8b97dd_2c14b6c1caf148afb23a3e2f4484cbc3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012cce.bin
53e59393e669e0e2b454e2a711f75b2843310cead8514bbf6af203ae82d5fe20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CCE 5228 bytes
font_01_sfnt_off00013eb0.bin
6b142cb0f6559677db2d7d752ada0c33974719a72c8a7acd368d346d75864c1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EB0 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.