Malicious PDF — malware analysis report

Static analysis result for SHA-256 24223dcc2222fadf…

MALICIOUS

PDF

81.8 KB Created: 2021-03-22 01:49:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 0703b076c110e63952a47dd4a49fc582 SHA-1: 8ebe1f85cf16f6db61a1e1f971b92131b2a79e83 SHA-256: 24223dcc2222fadf71a57e8590056559492c02befaf464705b3e8b93efc606aa
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'bologen.ru', which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to technical materials, aligning with a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=materials+for+civil+and+construction+engineers+4th+edition+chegg PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4412767/normal_600a4d3676840.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489259/normal_60081bbf984b6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371265/normal_6026e051582e4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381544/normal_604958d36ad9e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500450/normal_6046cf4282acc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4477651/normal_5fe1456a8b0a0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378857/normal_60388899d0294.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420592/normal_60365d0831265.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449405/normal_5fd3571a3734d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476437/normal_60443d867d4d7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448976/normal_6041ca19cde8f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486535/normal_6049df106245a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450037/normal_604d3348c396e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/d260d36a-6057-4b16-9f61-82184ddc06ec/79618162525.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c174b0f4-8013-4561-bf0d-dadad02ceb15/kifovoru.pdfIn PDF document text
    • https://s3.amazonaws.com/fidobakipivogit/emulator_android_pc_nox.pdfIn PDF document text
    • https://s3.amazonaws.com/wizuluworafid/flydubai_crash_investigation_report.pdfIn PDF document text
    • https://s3.amazonaws.com/vovopafubipu/28861402929.pdfIn PDF document text
    • https://s3.amazonaws.com/savifin/japanese_road_signs.pdfIn PDF document text
    • https://s3.amazonaws.com/jivamubug/alaris_8110_syringe_pump_service_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f590.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF590 5320 bytes
SHA-256: ddedbb6ff2c64752e89e7249a986569fd9cea44efb906d0c9ac2460b89c80c08
font_01_sfnt_off000107af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107AF 10500 bytes
SHA-256: 2e2e75a082ff03482c009a18e37c9afa18e4aa9477646064e47dd272ab2a557d
font_02_sfnt_off00012b6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B6A 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.