Malicious PDF — malware analysis report

Static analysis result for SHA-256 f399e6f6da902bc8…

MALICIOUS

PDF

68.1 KB Created: 2021-03-28 11:40:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 952dfd9c8e68011d7c448f99266eaa20 SHA-1: 6e1aa79e6c2be8ec936f242f75b872a0c7b237e6 SHA-256: f399e6f6da902bc8cdb0e8b34c2641ed219a1e329e5fe9f13c4147012746d3fe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. The embedded URL `https://golowaki.ru/award?keyword=ancyl+membership+form+pdf` is likely the primary lure, disguised as a membership form. No scripts were extracted, but the PDF structure itself facilitated the malicious URL delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=ancyl+membership+form+pdf
    • http://netekepipavosis.sportsontheweb.net/kubasebireganewaki.pdf
    • http://micrometerdigital.xyz/generic_programming_template16xnx.pdf
    • http://wiboratiraveguw.mygamesonline.org/kevaguxorinesikom.pdf
    • http://julapekawej.22web.org/aidetek_vc97_manual.pdf
    • http://nout-sale.site/realistic_car_crash_games_xbox_oneq29lo.pdf
    • http://kuvenumine.mygamesonline.org/dudijokoboveku.pdf
    • http://kelularuj.22web.org/lost_at_sea_movies_list.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8998f9c4-44e5-4687-b440-71a752dfb136/zefuwepesetefupatodet.pdf
    • http://libiwozurogufo.rf.gd/free_printable_country_sheet_music_for_keyboard.pdf
    • http://zarazemudaseri.epizy.com/choke_onerepublic_piano_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/c2a6998e-ab2b-40be-95b3-00a9b892681c/maserati_granturismo_2013_price_new.pdf
    • https://uploads.strikinglycdn.com/files/c828be13-dfa8-406d-8982-8963b313d3d4/how_can_trees_help_fight_climate_change.pdf
    • https://uploads.strikinglycdn.com/files/6c1ff00b-f607-4a5b-ba4c-681c62274fc1/55690361662.pdf
    • https://8c4778c4-ed17-4cf1-86f9-5448e21c5c15.filesusr.com/ugd/6da380_3e54e1571c204df7aaafe3d5f2529da5.pdf?index=true
    • http://zodotisejomiga.epizy.com/is_the_a_sequel_to_twilight_series_books.pdf
    • http://banugigo.epizy.com/gedumizagunosamedukuwidal.pdf
    • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_2df3bfaef6fb41c094893a1fb8e0e68d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c4b04f56-bee5-4d13-b5ba-4a3501a895f4/what_are_the_structured_products.pdf
    • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_175410cb57824551922759ecc297e4d9.pdf?index=true
    • https://2ae8fa2d-8b21-4cd7-bd94-b44763fb9b4d.filesusr.com/ugd/8e1ec7_3c876b04e77b4fbe8bcf80f59f09859b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc4e.bin
6d475539f8f11d36c866b3ae3eca7107ee8d427e9cb8e3d38b11e68c998c11cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC4E 5416 bytes
font_01_sfnt_off0000de95.bin
cd605169c139ae8f3ecf296d8335911a3706e622ffc9c72b5ab415ae190c605e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE95 10836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.