Malicious PDF — malware analysis report

Static analysis result for SHA-256 155d0972780338ee…

MALICIOUS

PDF

78.1 KB Created: 2021-03-15 20:19:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0abf41497a2b4128889ddd926c51eeae SHA-1: a74e91734dc4018c16c0b8417a351a015b96baf0 SHA-256: 155d0972780338eeb0cb3cc1035c87dc0cc646155aa83e8ff40b9b8fe73fcb9d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific ClamAV detection name indicating it's a phishing trojan. An external URI heuristic points to a suspicious URL, 'https://bologen.ru/award?keyword=bilomag+plus+ulotka+pdf', which is likely used to host or redirect to malicious content. While no scripts were explicitly extracted, the PDF structure and heuristics suggest an attempt to exploit users via a malicious attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=bilomag+plus+ulotka+pdf
    • https://wobajaxeme.weebly.com/uploads/1/3/4/3/134350369/niniroxororug_kevixin_lexodevu_vazemewudozad.pdf
    • https://cdn.sqhk.co/firijanab/kifhdie/audio_pro_addon_t5_orange.pdf
    • https://cdn.sqhk.co/disovaje/jtFFMji/14530665980.pdf
    • https://guditeni.weebly.com/uploads/1/3/4/5/134529862/6576547.pdf
    • https://cdn.sqhk.co/feletitami/hiZidgc/maserati_quattroporte_gts_price.pdf
    • https://cdn.sqhk.co/walumupo/ihciglh/open_house_nyc_host.pdf
    • https://cdn.sqhk.co/butiluluvuk/ghgekkS/.pdf
    • https://cdn.sqhk.co/pexufenek/eibgeid/pokemon_cafe_mix.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/dinisemowoge/nejunenilawiraxupugarani.pdf
    • https://s3.amazonaws.com/rodigapigeta/73202719246.pdf
    • https://025b4bf0-2906-4f5f-8a0f-6d4b68fc9518.filesusr.com/ugd/148ee2_1598d2e4103444f7886ea493da57bed6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bb986fab-305d-4e63-85cc-1c90927e65bc/natozitojad.pdf
    • https://75cc4b12-69da-4024-8422-75f9303faa99.filesusr.com/ugd/d6c222_6b808683d8d34f8d9ca41866d4b6cf5d.pdf?index=true
    • https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_baea8f4ad09d4609b9a6e15e4adb2658.pdf?index=true
    • https://s3.amazonaws.com/xamapebonijos/wolf_of_wall_street_quotes_matthew_mcconaughey.pdf
    • https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_cb84aa60ad0d4d4f9f92634e0ec98e8f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bdbd232d-cdfb-4180-8e2d-32b52148fd6b/vizisazagisisut.pdf
    • https://uploads.strikinglycdn.com/files/626fc3cc-d47a-48d6-826d-cb875af3a443/how_to_get_my_night_owl_cameras_online.pdf
    • https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_6e8fa6c7ca5d4c9592e668f286664491.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e059.bin
501df71a4a713c189d35b022a80c090fe9df8b0cd624de6e1b35cc27cc0436ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE059 5036 bytes
font_01_sfnt_off0000f182.bin
94c408b4ad4658546df925963d6e5d6a238f32ffe65620ca408623f7e9331d60		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF182 13744 bytes
font_02_sfnt_off00011be6.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BE6 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.