Malicious PDF — malware analysis report

Static analysis result for SHA-256 2fb19b28c235c787…

MALICIOUS

PDF

67.1 KB Created: 2021-03-20 18:09:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1ae9b269aafb59fe7c07c738a0f45f2 SHA-1: 4f7c155c2b3590ff2d03052434e527fa16b998f1 SHA-256: 2fb19b28c235c787a16ab2077350c371fa99ed7260a4f93b99480207edf9a9c8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of an external URI. The embedded URL, https://bologen.ru/wix?keyword=kensuke%2527s+kingdom+worksheets, is likely used to deliver a malicious payload or phish for credentials. The document body, though heavily obfuscated, suggests a lure related to 'Kensuke's kingdom worksheets', aligning with a phishing or social engineering attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=kensuke%2527s+kingdom+worksheets
    • https://cdn-cms.f-static.net/uploads/4391954/normal_602495ce23800.pdf
    • https://cdn.sqhk.co/xorilulog/miJgjji/space_trader_games_pc.pdf
    • https://cdn.sqhk.co/makubeku/gjicRij/76701846142.pdf
    • http://gizovivomiz.getenjoyment.net/gukemux.pdf
    • https://static.s123-cdn-static.com/uploads/4480594/normal_5fff70706a5e6.pdf
    • https://cdn.sqhk.co/nojedajoze/eiewidW/how_to_write_a_simple_business_plan_template.pdf
    • https://cdn-cms.f-static.net/uploads/4459805/normal_600b211395802.pdf
    • https://static.s123-cdn-static.com/uploads/4375894/normal_5fffcb6ab440a.pdf
    • https://cdn-cms.f-static.net/uploads/4387703/normal_5fdb687c39d2c.pdf
    • https://static.s123-cdn-static.com/uploads/4459470/normal_5fe1709031136.pdf
    • http://vogudikomi.getenjoyment.net/lorubaxifubev.pdf
    • https://cdn-cms.f-static.net/uploads/4484631/normal_5fda8b0c3cd38.pdf
    • http://zinazeripu.22web.org/adjetivos_en_ingles_con_imagenes.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kogusox.epizy.com/dulebajapawete.pdf
    • https://0ea1ff7f-05b3-43a2-9744-178351a05ed1.filesusr.com/ugd/01f9b9_3c3f8fb93f6e4d048a3c522948481019.pdf?index=true
    • http://vobikeretuwof.atwebpages.com/befefolawufowiru.pdf
    • http://dawutanarav.epizy.com/worksheet_for_speaking_practice.pdf
    • https://c2267750-1f6d-4c2f-944a-eb302c7f07d7.filesusr.com/ugd/93971e_ad05c2ce2a89405fbde3063797dcfd43.pdf?index=true
    • https://cc652f91-b1ab-470c-b36f-46d838ef85b2.filesusr.com/ugd/fbccce_42afa31a6b9548faa9dd77d29b3e3263.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9df.bin
b18aef9834eb27c4a0b599ddd5b6ab13d43e460857afa5798b80c4c98e6492c7
pdf-font-stream PDF embedded font (sfnt) at offset 0xC9DF 5156 bytes
font_01_sfnt_off0000db5b.bin
ec838360c94937908af4dffa2c508f756ba9ddeeea63f5ddf54d9dec1cc6259e
pdf-font-stream PDF embedded font (sfnt) at offset 0xDB5B 10508 bytes