Malicious PDF — malware analysis report

Static analysis result for SHA-256 266d3ee127bd50eb…

MALICIOUS

PDF

69.6 KB Created: 2021-02-24 12:23:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 4f16a4e2a73c983b92a9ab56e4d8edef SHA-1: cdb4bc71e04c3efadf89911a476d7ca60fe85f22 SHA-256: 266d3ee127bd50ebd7eb71b0dfe41f98af2ac613c99da3382fa95b0924783219
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'https://bologen.ru/aws?utm_term=shure+ulx-d+wireless+microphones', which is likely part of a phishing lure. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest an attempt to redirect the user to a malicious site, consistent with spearphishing attachment tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/aws?utm_term=shure+ulx-d+wireless+microphones PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4501231/normal_6028111aae8a4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459164/normal_6025454801b02.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457000/normal_5ff9aa00aaaa2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368248/normal_60328f5f79eb7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467955/normal_5fdccb6e6f5c3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495043/normal_600df873608d5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486206/normal_5ffb343e570f4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4469350/normal_5fca7f64574a2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vujoponax.epizy.com/zusogul.pdfIn PDF document text
    • https://s3.amazonaws.com/dukexajuj/icom_706mk2g_service_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/46336920325.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/android_adapter_getview_return_null.pdfIn PDF document text
    • http://zojimako.rf.gd/where_are_you_from_in_korean_informal.pdfIn PDF document text
    • https://s3.amazonaws.com/pekatikisuruki/jugajed.pdfIn PDF document text
    • https://s3.amazonaws.com/pasawe/c_or_k_spelling_rule_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/liwara/sidezadutegewasakojonup.pdfIn PDF document text
    • http://deroselewem.epizy.com/85372808964.pdfIn PDF document text
    • https://s3.amazonaws.com/kavalukato/the_bachelors_full_movie_free.pdfIn PDF document text
    • https://s3.amazonaws.com/sorapobuk/14027767845.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d192.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD192 5396 bytes
SHA-256: 7b6592034f959f76dd5cffc58d2f3b5d0729705c3cc1fbd9a5e3a3225b9bd3e4
font_01_sfnt_off0000e3e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3E4 11832 bytes
SHA-256: f07b83285a4f78085af5ba1d457c48b4a04f6ad764c55ab3f9afda035c7d7e11

Open this report in the interactive analyzer, or submit your own file for analysis.