Malicious PDF — malware analysis report

Static analysis result for SHA-256 84cb944d4474bb46…

MALICIOUS

PDF

89.2 KB Created: 2021-03-05 08:00:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4e34be3ef3eb9c71860892e42635b09 SHA-1: ea7abc958c300b4958bf4d9f78b01435ec3a9752 SHA-256: 84cb944d4474bb467991499b09d80ca6ab03a64686cf34423dd150eef30abef2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://bologen.ru/wix?keyword=lasiodora+parahybana+enclosure', which is likely a phishing or malware distribution site. The document body appears to be heavily obfuscated or corrupted, preventing a clear understanding of its direct lure, but the presence of the malicious URI is a strong indicator of its intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=lasiodora+parahybana+enclosure
    • http://zuzatew.medianewsonline.com/what_is_the_meaning_of_apple_tree_in_dream.pdf
    • https://cdn-cms.f-static.net/uploads/4374535/normal_5fdad7e6182b7.pdf
    • http://punavuvipufov.sportsontheweb.net/29492237086.pdf
    • https://cdn-cms.f-static.net/uploads/4471467/normal_601618ef3737f.pdf
    • https://static.s123-cdn-static.com/uploads/4471236/normal_5fe29ace08cd6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wokarodefi.onlinewebshop.net/how_to_write_a_great_career_development_plan_for_employees.pdf
    • https://uploads.strikinglycdn.com/files/bc81992e-ac0a-44f7-8c2d-5bfa58bb3c0f/zorosirek.pdf
    • https://uploads.strikinglycdn.com/files/7ab1f761-e0ec-4c40-8ffe-4ef51646c7c1/how_the_grinch_stole_christmas_book.pdf
    • https://s3.amazonaws.com/divelikubapiwaj/assassin_s_creed_origins_hidden_trophy_guide.pdf
    • https://s3.amazonaws.com/sakaburepagase/honeywell_security_system_keypad_manual.pdf
    • https://5984e891-aecd-43e6-866f-efdb297c9c35.filesusr.com/ugd/403565_29cc4ba019304f50ad5b03e9af78a314.pdf?index=true
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_2e8e540e24be43018bf2df314ba07f9b.pdf?index=true
    • http://wugujub.onlinewebshop.net/6_ps_marketing.pdf
    • https://uploads.strikinglycdn.com/files/111d1c78-27d1-4f4d-bef8-c5d9a3ef6436/h20_x5_steam_mop_pads.pdf
    • https://8d684a1e-4078-49cd-b336-05adf09473b6.filesusr.com/ugd/2b25e8_ed84ef34d5b94928ba5ba08632804a68.pdf?index=true
    • http://widifusi.myartsonline.com/817107389.pdf
    • https://ec679cc6-872a-45a8-b2fd-b1bc8f6ddb77.filesusr.com/ugd/d1d005_b37fd42d8e4746948b8d2b0fa9508a02.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bba80ac6-3724-4eb3-a342-5227a429d1a5/zerilewolukasabi.pdf
    • http://wenares.myartsonline.com/marketing_management_salary_in_south_africa.pdf
    • https://uploads.strikinglycdn.com/files/ca24b69e-0269-4a6b-8cf1-aab50509dc7b/xuginogutomipowoxufagaro.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000111d9.bin
c333ba22e17a371443e6470d5ce37c99df15a6fa5e9a492aa044c983b78d479f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111D9 5148 bytes
font_01_sfnt_off00012342.bin
ccb1885e0467ca5c2c19e579fc3f92f74c800c2116edbc677d312b880808e0ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12342 11332 bytes
font_02_sfnt_off00014933.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14933 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.