Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f84fad3d8b616ab…

MALICIOUS

PDF

84.2 KB Created: 2021-02-14 05:47:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: ff3dcd54d984804fc9742d20ec5e0780 SHA-1: 232e0dda5eb3e5bd780ce3bfaf94fe4f0c3edd0d SHA-256: 9f84fad3d8b616ab220c3d9e706cca6b64d81c5749e0beda8328a633a615b997
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL `https://bologen.ru/wb?keyword=checkbox%20react%20final%20form` suggests a phishing or redirection attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are commonly used for delivering malicious content or leading users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wb?keyword=checkbox%20react%20final%20form PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454673/normal_600b314e200f9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409607/normal_5ff26a991e4f8.pdfIn PDF document text
    • http://gitaxodepa.iblogger.org/93420340761.pdfIn PDF document text
    • http://raisinsapp.club/lovebajofajor7xll8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450240/normal_5feb7be397b33.pdfIn PDF document text
    • http://begamigojas.iblogger.org/valvular_regurgitation_echo_guidelines.pdfIn PDF document text
    • http://itfamily.info/59096264661okklb.pdfIn PDF document text
    • http://chempion.coffee/97912867887poaoi.pdfIn PDF document text
    • http://xusibujisexin.22web.org/leopard_gecko_guide_care_sheet.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424347/normal_5fe1198445987.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415934/normal_5ff14180908ff.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487206/normal_5fe246f6dbd30.pdfIn PDF document text
    • http://kersita.fun/83991509513aw70e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418590/normal_5fdbfc5dcda30.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478127/normal_5fe527d04366d.pdfIn PDF document text
    • http://parkji5x.xyz/tupivesonoz7kmmx.pdfIn PDF document text
    • http://insurancesouk.com/84351263333umsjp.pdfIn PDF document text
    • http://mrt36.ru/17594363664xefic.pdfIn PDF document text
    • http://sfr-espace.best/pudazj890o.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452593/normal_601b01049a7a9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fumesowira.epizy.com/linear_equation_graph_worksheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1E3 5120 bytes
SHA-256: 4d6d01e4020a740c9874aceba081c5d83f7a547e0c23e944beb22776cf505870
font_01_sfnt_off00010328.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10328 12268 bytes
SHA-256: 20316fc5c5d7265ae70db8b08547cb05ca969113b77f273e597d2e5534a198bd
font_02_sfnt_off00012d67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D67 16344 bytes
SHA-256: 2f7f7312c0bd5ba6b14efbdb686f51d09214b70b6ea1c6bcbe039cfd480b5877

Open this report in the interactive analyzer, or submit your own file for analysis.