Malicious PDF — malware analysis report

Static analysis result for SHA-256 1fbb144b3b9443ee…

MALICIOUS

PDF

79.1 KB Created: 2021-02-23 20:43:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 55f5f393c52bf049e8028a96f47e7ead SHA-1: 080c2c8bdd1a8e509feef8919378062fc7481cee SHA-256: 1fbb144b3b9443ee962e0c5d86d39bc5685f753796390c0487b02dbe5cb5abd3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, 'bologen.ru', which is likely used for phishing or to host a secondary payload. The document body, though heavily obfuscated, contains metadata suggesting it's a disguised technical document, aligning with social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=cisco+air+lap1142n+e+k9+datasheet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4420911/normal_5fe9daee5e08c.pdfIn PDF document text
    • http://espaceclient-cmb.com/where_is_bluetooth_on_samsung_tvkgx82.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450434/normal_5fcde007ddca8.pdfIn PDF document text
    • https://fadunununi.weebly.com/uploads/1/3/4/7/134747036/lelubigijimef-ketaxozazipaj-tevidolekasu.pdfIn PDF document text
    • http://formblckr1.xyz/decimal_worksheet_5th_gradewpw6o.pdfIn PDF document text
    • http://dsv-trening.ru/the_shape_of_things_book_neil_labuteu27i8.pdfIn PDF document text
    • https://lurafavef.weebly.com/uploads/1/3/0/8/130813461/taduxij.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421764/normal_60199979328eb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393483/normal_5ff866ec0a141.pdfIn PDF document text
    • http://instapodarok.site/sample_effort_estimation_template_for_software_testingh5ogx.pdfIn PDF document text
    • https://toxoladosa.weebly.com/uploads/1/3/4/4/134479392/valuratipepo_pejebarobevot.pdfIn PDF document text
    • https://fekugutupufug.weebly.com/uploads/1/3/4/8/134876907/0511d23d3f9d.pdfIn PDF document text
    • http://mmuuue.space/snapseed_for_pc_windows_76f3fr.pdfIn PDF document text
    • http://lodixewovufosa.iblogger.org/hipaa_certification_exam_answers.pdfIn PDF document text
    • http://taxokisekajetek.22web.org/7134015718.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jalasilunaz/yamaha_natural_sound_av_receiver_rx-v663_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/lerezazo/label_format_template.pdfIn PDF document text
    • https://s3.amazonaws.com/defujo/10th_class_science_ncert_book_question_answer.pdfIn PDF document text
    • http://vujesidewu.rf.gd/joraxerib.pdfIn PDF document text
    • https://s3.amazonaws.com/lorifumofelu/17609249334.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f237.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF237 5560 bytes
SHA-256: 3d73173500b862b1dd282f7aff9a8368a8bdd480a1fe0864e2be5c0d97f7e133
font_01_sfnt_off00010520.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10520 12592 bytes
SHA-256: 1fc728ae34bea9c17299f06414e98ff23b4f602a00a2138e82736052aa80bd39

Open this report in the interactive analyzer, or submit your own file for analysis.