Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b21e0958d54d91e…

MALICIOUS

PDF

81.3 KB Created: 2021-03-25 06:01:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a280c81b4d9e6317bcda279729d4d20e SHA-1: 920d2ee84f8d4bddbecae44ef19f5cb15e8860a9 SHA-256: 4b21e0958d54d91e28d8a5e73edaa03dff6997cad3d03bcb67290caa43d03eab
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'bologen.ru', which is likely the malicious destination. The document body, though heavily obfuscated, suggests a lure related to a 'Budapest city centre map pdf'. No scripts were extracted, but the presence of external URIs and the malware classification strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=budapest+city+centre+map+pdf
    • http://gexopidikimo.mygamesonline.org/john_deere_commercial_mowers_for_sale_used.pdf
    • https://cdn.sqhk.co/lafuwexale/ichffhi/lijonisidaboruwigos.pdf
    • http://kasiwewevono.iblogger.org/lazeduwobitajofexovuwom.pdf
    • http://lobabinuladeri.medianewsonline.com/fisher_and_paykel_dish_drawer_not_emptying.pdf
    • http://suxulopiluv.22web.org/descriptive_statistics_analysis.pdf
    • https://cdn.sqhk.co/zijigemeworu/KyhhgdX/balenciaga_shoes_mens_high_top.pdf
    • https://cdn.sqhk.co/siganewita/ghgfbgc/comparison_chart_template_google_sheets.pdf
    • http://legugoboxebepe.22web.org/mapa_de_riesgos_excel.pdf
    • https://cdn.sqhk.co/badaxiloru/hjhdbCo/nopum.pdf
    • http://ninijefaligogi.mygamesonline.org/green_day_boulevard_of_broken_dreams_tab.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/b0ff2354-a023-4017-9f78-1cc79ac719e4/viwigazivefanonemago.pdf
    • http://gokosipok.rf.gd/angiografia_pulmonar.pdf
    • https://788ae96d-7a4f-4726-91a9-07bb742fb3e7.filesusr.com/ugd/97aff7_10540527f7444aa79006ee29208f051c.pdf?index=true
    • https://0fc0baf9-b884-4fcd-968e-f93c0f938930.filesusr.com/ugd/68ec51_d5baafa98ac44d37b1fdd40943600041.pdf?index=true
    • https://96daf755-36ed-4ece-a185-bed8db3f70ea.filesusr.com/ugd/a95cda_2ab8fe3a161d4368bbd1cfa4d52bcb58.pdf?index=true
    • http://remobufu.rf.gd/87071174000.pdf
    • http://zifosasexinedi.rf.gd/tecsun_pl-380_manual.pdf
    • http://nelaxufap.rf.gd/14721262804.pdf
    • http://momagewaxogagu.epizy.com/legeguvolopumajamidegugex.pdf
    • https://uploads.strikinglycdn.com/files/90a37945-5ee3-4b9b-bc87-3d514c5790e8/un_curso_de_milagros_leccion_275.pdf
    • https://d75bbb92-b0e4-4b50-83e6-2443e695523b.filesusr.com/ugd/bc73b9_b3a6a7c9d6124c9e9c42dc72f48d0b16.pdf?index=true
    • http://sosasofojatage.epizy.com/3rd_conditional_conversation_questions.pdf
    • http://liraperuwuw.atwebpages.com/fevegen.pdf
    • https://c1e70603-6ca1-47bc-880b-b60d7d434995.filesusr.com/ugd/df625d_a7b752a872d7443caa6d1088e69c7a31.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1f0.bin
a1d57df62fa5ea4c2ca350d896e51754101cd027822715bbb042b8bb3ff96c12		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F0 5192 bytes
font_01_sfnt_off0001037c.bin
6dd9c4d69390ec8791987797db90e8934bafb30fce4bf47f62f0979df1d0fa69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1037C 11324 bytes
font_02_sfnt_off00012915.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12915 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.