Malicious PDF — malware analysis report

Static analysis result for SHA-256 d95e41ee17ecb866…

MALICIOUS

PDF

82.9 KB Created: 2021-03-22 10:47:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 4ca5154c32e7d04f2411481bcbc8f170 SHA-1: dea9c5d7257625ed5af47e8eb7fb7480c8c6c59e SHA-256: d95e41ee17ecb86645bbab95aed22183fc16693aa803b75bb4fd657339f98097
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://bologen.ru/strik?utm_term=what+does+rt+44+mean+at+sonic', which is likely part of a phishing or redirection scheme. The document body's content is heavily obfuscated and appears to be a lure related to search queries.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=what+does+rt+44+mean+at+sonic PDF link annotation
    • http://onlyforyou.space/call_of_cthulhu_6th_edition_character_sheet_fillable23isr.pdfIn PDF document text
    • https://cdn.sqhk.co/miranilu/hcqRgAa/addition_to_5_worksheets_grade_1.pdfIn PDF document text
    • https://cdn.sqhk.co/fowoleleda/ic2dig9/kamevojabosaxawun.pdfIn PDF document text
    • http://idealica-co.site/stardew_valley_movement_speedn5obj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9575a61a-a671-4cc3-8538-ed36ed22d933/how_do_i_use_my_weight_watchers_calculator.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95efa8a0-2202-4993-8ab4-508c6a006514/siroxiluwulupuguveg.pdfIn PDF document text
    • https://s3.amazonaws.com/niporofez/nateg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21fca2c7-10fe-4fb7-b4f3-66ff45ab8a87/banefamosuzolorekipeg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41442c48-8bcf-4a61-8d5f-14ec3469f0ab/how_to_allow_flash_on_chrome_by_default.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95aa561d-bf46-48b8-8f80-dd867ea0d743/bash_script_echo_variable_in_string.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c5f8071-e726-4aee-aa8c-eb64b063baa2/bitinotaxilegepuvov.pdfIn PDF document text
    • https://s3.amazonaws.com/dapekufoxiraku/90476002313.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fee6c4a8-865e-418b-87cb-50b3e675ef8a/libufunitukonibej.pdfIn PDF document text
    • https://s3.amazonaws.com/marimejerebo/how_to_get_crown_royal_peach.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00839ba4-eec2-4343-84cd-5312436fdd1b/verb_worksheets_grade_2.pdfIn PDF document text
    • https://s3.amazonaws.com/zodawanuror/name_that_angle_pair_color_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f193c6c2-d001-4d2a-9e3c-763cc2bca8bc/how_many_red_aces_are_in_a_deck_of_cards.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2894a8fd-3ec6-4d53-9677-e4f9d2d1d4c8/28427144442.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f17f0be-c8ab-43f4-b6f8-57182511b6fa/polishing_single_stage_urethane_paint.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fabc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFABC 2900 bytes
SHA-256: 10a07fc969e6c8cf41398fcfefa625e426b29a45b33f3716d0886db1405c0d2a
font_01_sfnt_off000104ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104FF 5248 bytes
SHA-256: b747f15d4125420ac47fae413d503041f18be6e1509ceddf1e823eeae100c553
font_02_sfnt_off000116c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116C1 11524 bytes
SHA-256: dc814f294ee2ddb7d5ffb368f8e14a6b9fb394ded8b25d49217460b6ccc4d336

Open this report in the interactive analyzer, or submit your own file for analysis.