Malicious PDF — malware analysis report

Static analysis result for SHA-256 5354f42dd3e8541f…

MALICIOUS

PDF

78.4 KB Created: 2021-03-25 04:33:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 4558bef1063e0ed81f2603079e8504db SHA-1: 18d5f9a61a8c8ebeaeb5df2791373434b24f5cc5 SHA-256: 5354f42dd3e8541fbc911c64befe89a84933f118d56d9957c70a0d15c1ac5b99
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://bologen.ru/wix?keyword=meet+me+in+st.+gallen', which is a strong indicator of a phishing attempt. The document body, though heavily obfuscated, contains text that appears to be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=meet+me+in+st.+gallen PDF link annotation
    • https://cdn.sqhk.co/kurafuso/AhdjfNQ/wordscapes_answers_level_1150.pdfIn PDF document text
    • https://cdn.sqhk.co/zidodovare/oZMifih/xuvusadarumanorefogidikig.pdfIn PDF document text
    • http://nuwevabufa.mypressonline.com/63884616734.pdfIn PDF document text
    • http://pemowovamig.iblogger.org/21092725348.pdfIn PDF document text
    • https://cdn.sqhk.co/perolurowona/jjBvhgE/flight_tickets_booking_app.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_182b5a2b7f7b4d58b8d39b8c72645501.pdf?index=trueIn PDF document text
    • http://misosemarimo.rf.gd/utorrent_2._2_1_android.pdfIn PDF document text
    • https://s3.amazonaws.com/donukadizolin/sukij.pdfIn PDF document text
    • http://nojikigor.myartsonline.com/xorukodijak.pdfIn PDF document text
    • https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_12ec520da13a459ca8aa9d218c713412.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/firudegix/nouns_worksheets_6th_grade_free.pdfIn PDF document text
    • http://bixozebaxikapos.atwebpages.com/6910451281.pdfIn PDF document text
    • https://s3.amazonaws.com/zabevog/brindisi_report_cronaca_san_donaci.pdfIn PDF document text
    • https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_5a37e588ad7e4c61bd1bd291d6ec21be.pdf?index=trueIn PDF document text
    • https://c4e42e93-254c-4ba8-b495-737f84002742.filesusr.com/ugd/ddb60a_7d1a213026544ce7a2bac26abb506473.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dalava/asphalt_xtreme_android_1.pdfIn PDF document text
    • http://vugugemo.atwebpages.com/good_night_messages_for_her.pdfIn PDF document text
    • https://s3.amazonaws.com/dikobepibelun/porter_cable_dovetail_jig_4216_video.pdfIn PDF document text
    • https://c30b87d5-e38e-4f4c-8f61-e356d9eaafe8.filesusr.com/ugd/347120_d86fb4ea17f741d2aeff06d0dd54f15f.pdf?index=trueIn PDF document text
    • https://badbb018-ab4e-499b-b788-960949b82e3d.filesusr.com/ugd/4f4c56_81f2167c1908447683e1cdf531c48df1.pdf?index=trueIn PDF document text
    • http://kufekisawisewo.onlinewebshop.net/autocad_import_scale.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f564.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF564 4948 bytes
SHA-256: 7a8b2983af9bbb907ab49593ef047647eb30a58c6a27b8c5a7c16b0ffc88e4bf
font_01_sfnt_off0001063a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1063A 11472 bytes
SHA-256: 60fd8e7d80791c695e1ada3efe5de9dc37a4b2f0cdb6b2f39174d7abf34c6e56

Open this report in the interactive analyzer, or submit your own file for analysis.