Malicious PDF — malware analysis report

Static analysis result for SHA-256 92646108554611aa…

MALICIOUS

PDF

90.7 KB Created: 2021-02-20 23:17:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: 0179a82dc61f689882c85265eaf652c9 SHA-1: 07044129db03e0ec39ce217d6d56d86ef1652f70 SHA-256: 92646108554611aaf069bcab0b590ee0b22685640e09f1c29c44c044dad2adf3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://bologen.ru/wb?keyword=what%20does%20houlihan%20mean%20in%20irish', suggesting a phishing or social engineering lure disguised as a search result. No scripts were extracted, but the presence of external URIs and the overall detection profile points to a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wb?keyword=what%20does%20houlihan%20mean%20in%20irish PDF link annotation
    • https://cdn.sqhk.co/libavesonon/Tjf0Uq7/rigikod.pdfIn PDF document text
    • http://dewiluvafaridi.22web.org/86386084662.pdfIn PDF document text
    • https://cdn.sqhk.co/wobuwozavenu/DljgHii/12857625584.pdfIn PDF document text
    • https://cdn.sqhk.co/pirujezexod/d8jgget/65538628094.pdfIn PDF document text
    • https://cdn.sqhk.co/jipogidara/bhvHBWD/new_york_city_wallpaper_hd_iphone.pdfIn PDF document text
    • https://cdn.sqhk.co/mitukutowum/hdhajTw/apple_afterburner_card_performance.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416806/normal_601280cb4ed38.pdfIn PDF document text
    • https://cdn.sqhk.co/xoberuweri/eigjceA/world_adventure_dora.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fijoxim.epizy.com/panera_bread_nutritional_information_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/kotenu/33660322417.pdfIn PDF document text
    • https://s3.amazonaws.com/bisapovepizaj/50841496266.pdfIn PDF document text
    • http://kubusefot.epizy.com/jitemoderuwagopukok.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/wulajaperaxuz.pdfIn PDF document text
    • http://womopemi.epizy.com/49220479837.pdfIn PDF document text
    • https://s3.amazonaws.com/xubifupi/building_construction_plans.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD7E 4156 bytes
SHA-256: 40e3587647168eb2f15d9bd940dd1534d0bce061c35e39909554302fb99c99e1
font_01_sfnt_off0000dc22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC22 5076 bytes
SHA-256: 20b61aa5e5bb9a7bdb6350fa4b3c2b0a4a5fcce53e4a61e7af9372e95a5f4b51
font_02_sfnt_off0000ed3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED3E 2656 bytes
SHA-256: ff8289fcab20b7b81f5dc7c47458689637225d7099c48932a46d6898d6123f6c
font_03_sfnt_off0000f844.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF844 2108 bytes
SHA-256: 5fc9e2cd4e7ad04544edda2023dd698132b65daf167a61e09de9fd8de66d8b52
font_04_sfnt_off0001020f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1020F 6244 bytes
SHA-256: aa27ff5f55262cfa566fa9394baad46dc5c31bf2191e33a98eef31acc5d2fa9e
font_05_sfnt_off00011247.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11247 15084 bytes
SHA-256: 9f34b45ba914d3ad90f31df6078941ba898c1a7abbac01bb1e0be0d56d1cabcb
font_06_sfnt_off00013f72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F72 18148 bytes
SHA-256: 2d8f89f94fb4d0673082de8c2c8475eb6db280d923adce0fc874ab38e7245e81

Open this report in the interactive analyzer, or submit your own file for analysis.