Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cbb05ed5a6bed77…

MALICIOUS

PDF

72.3 KB Created: 2021-03-17 01:04:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 885e82744dbe07a8acbdb4ec22cda902 SHA-1: d899ed4cfcdd1c6c06a5e9845baacb2915a53562 SHA-256: 1cbb05ed5a6bed77dd78a38db2879aa9b6663ac23921bba5c360b4c8019911b1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains references to a crossword clue and the wkhtmltopdf tool, suggesting a lure. A critical heuristic identified an external URI pointing to 'bologen.ru', which is highly suspicious and likely serves as a phishing or malware distribution endpoint.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=the+hindu+trinity+crossword+clue
    • https://cdn.sqhk.co/xexisini/nZ1ziaZ/north_and_south_free_online_read.pdf
    • http://zodelem.mygamesonline.org/bomuwolugewiwezuvof.pdf
    • https://cdn.sqhk.co/zidodovare/fjgEQhj/game_of_war_fire_age_movie_download.pdf
    • https://static.s123-cdn-static.com/uploads/4387825/normal_5ff8f68ac6c2c.pdf
    • https://cdn-cms.f-static.net/uploads/4379482/normal_6038c7cabc03a.pdf
    • https://cdn.sqhk.co/bepeguvovori/t0agghf/33640476743.pdf
    • http://kewatupu.scienceontheweb.net/breast_cancer_staging_2020.pdf
    • http://vobalemujumojak.mywebcommunity.org/sodogabefotar.pdf
    • https://static.s123-cdn-static.com/uploads/4422150/normal_5ff68046336df.pdf
    • http://pixidilivutep.medianewsonline.com/do_rca_tvs_have_optical.pdf
    • http://faripofijukevom.mywebcommunity.org/28494070768.pdf
    • http://gujozulogisin.scienceontheweb.net/garmin_gpsmap_60csx_map_update.pdf
    • http://wejuzofibab.medianewsonline.com/38131200578.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://e9542b43-fb79-4c62-94a9-c66526381fce.filesusr.com/ugd/4142f3_eb1fb889c8e540eebf45371b237c204e.pdf?index=true
    • http://kesupipipiret.onlinewebshop.net/77699380790.pdf
    • https://uploads.strikinglycdn.com/files/38f63b46-7dec-4ade-bd6b-f84ff3688143/how_to_find_the_surface_area_of_a_regular_polygon.pdf
    • https://uploads.strikinglycdn.com/files/2c14f8af-b8ed-4c90-b08c-18db4e76ec22/the_body_collector_movie_review.pdf
    • https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_6efe152061a0444aa2188ddec69bde0f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/50425150-8cbd-402f-b2fa-d343ffb9c578/ejercicios_verbos_irregulares_en_espaol.pdf
    • https://uploads.strikinglycdn.com/files/fcd39bfa-69b3-428a-b442-a021c1d5b204/18885448851.pdf
    • https://uploads.strikinglycdn.com/files/d3796298-ce97-4be8-868e-7885089575ce/how_to_put_a_belt_on_a_dirt_devil_vacuum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d11d.bin
cdaf1b1f9803c40e49bbdaa819021abc451e103c037cc6270b7ef128956cb751		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD11D 4840 bytes
font_01_sfnt_off0000e194.bin
f3bad8baa32383829bb5a2e95005e000a0fc84ef6c1ab4288909dad5df4e0a8b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE194 10572 bytes
font_02_sfnt_off0001058f.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1058F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.