Malicious PDF — malware analysis report

Static analysis result for SHA-256 d822a1b6b8de415d…

MALICIOUS

PDF

175.2 KB Created: 2021-03-17 12:38:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 84564296af8b5613d3ae9ad33f9e4a0f SHA-1: 7a61650170d163fe5ee84affadb63e238fb8b0b8 SHA-256: d822a1b6b8de415d7800eedfb1a937d19bc1ff98adeff2d6bec5f0ab6d53f579
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'bologen.ru' suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=d%2526d+5th+edition+monster+manual+2
    • https://cdn.sqhk.co/kitujesijak/VhgielM/99847149142.pdf
    • https://static.s123-cdn-static.com/uploads/4416318/normal_5fee91ddb0b23.pdf
    • https://cdn-cms.f-static.net/uploads/4454055/normal_600f5a54db955.pdf
    • https://cdn.sqhk.co/sutadejuna/lujj5ig/spelling_correction_dictionary_free.pdf
    • https://cdn-cms.f-static.net/uploads/4368756/normal_60118aec2316e.pdf
    • https://cdn-cms.f-static.net/uploads/4401555/normal_6039672595813.pdf
    • https://static.s123-cdn-static.com/uploads/4410703/normal_5fcb9bcd19813.pdf
    • https://cdn.sqhk.co/zojixemem/ifih9ig/knight_rider_cast_april.pdf
    • https://cdn-cms.f-static.net/uploads/4492281/normal_602d5fd393abc.pdf
    • https://static.s123-cdn-static.com/uploads/4500878/normal_5fdfdb1d99844.pdf
    • https://cdn-cms.f-static.net/uploads/4464065/normal_5fd68302cc1e3.pdf
    • https://static.s123-cdn-static.com/uploads/4476436/normal_6006ca2f3e43e.pdf
    • https://cdn-cms.f-static.net/uploads/4499282/normal_6022afcec9d48.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_74751cc30ac0444880ed184c0eaafcf9.pdf?index=true
    • http://xomutojekes.myartsonline.com/pablo_neruda_famous_poems_in_english.pdf
    • https://uploads.strikinglycdn.com/files/b5143ba8-43cb-4cae-bd7a-cae17cf0b711/anna_julia_cooper_quotes.pdf
    • http://nufulavidibime.myartsonline.com/international_business_college_indianapolis_in_46256.pdf
    • https://uploads.strikinglycdn.com/files/f1f52d14-0e1a-43c4-ae16-6313f838c3be/how_to_replace_kitchen_sink_sprayer_hose_moen.pdf
    • https://uploads.strikinglycdn.com/files/37e8ada2-b286-44e2-abdd-e8624a544bb4/89762829275.pdf
    • http://niselasot.atwebpages.com/mezik.pdf
    • https://uploads.strikinglycdn.com/files/b885f1a3-458a-4372-a284-8a133a2b752f/70753151801.pdf
    • http://wobanunep.myartsonline.com/wendys_company_nutrition_information.pdf
    • https://uploads.strikinglycdn.com/files/0b52d5ef-0099-40c2-8bce-dae087a8e1bf/ligavevin.pdf
    • https://f87ce62f-3d5d-4c42-bff3-2e7d00444551.filesusr.com/ugd/72ed28_18dcaf8379d640c592f2e6673adc7ff0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000250f0.bin
5bcf7f318894cd8667f709bf970fa8c582a8027402ea75fdf14ac0e15260a4d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x250F0 4156 bytes
font_01_sfnt_off00025f1e.bin
ebd009da0a4d40c538614706dbb4d0d4d2d321699484312e4a047ab225041883		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25F1E 15544 bytes
font_02_sfnt_off00028eef.bin
d0a3e12665bb40bb9585d38a9f94e4df01e71098ae9a9c9a8e1476bbec271044		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28EEF 19488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.