Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc00a9b4150be24c…

MALICIOUS

PDF

117.2 KB Created: 2021-02-14 02:30:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: d67b1d84f1fc15bd20dd1dcd45d47a6a SHA-1: 3323aaf53e16fceef181e6c813a60f7bc749b116 SHA-256: dc00a9b4150be24c36328856d385867fc7defb7994ee6b0bef5f51a2c2362ac2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'bologen.ru', which is likely part of the phishing lure. Although no scripts were explicitly extracted, the nature of the detection and the presence of a suspicious URL suggest an attempt to direct the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9912

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=polish+male+names+starting+with+w PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4450636/normal_60248c44922b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369179/normal_5ff46e65c6933.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465012/normal_5ff690db160da.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485010/normal_5fc6746ad4f89.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405459/normal_5fcbc704eae21.pdfIn PDF document text
    • http://wexakevo.22web.org/authorization_form_to_release_medical_records.pdfIn PDF document text
    • http://vifijes.22web.org/same_love_piano_sheet_music.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.thdl.org/http://www.thdl.org/TibetanIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/jolituzoji/psychology_statistics_for_dummies_cheat_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/dibedamoka/autocad_2004_pc_software.pdfIn PDF document text
    • https://s3.amazonaws.com/tugabijenovili/live_channel_app.pdfIn PDF document text
    • http://zuraravata.epizy.com/best_android_emulator_for_pubg_quora.pdfIn PDF document text
    • https://s3.amazonaws.com/memobofilenabon/biology_corner_worksheets_microscope.pdfIn PDF document text
    • https://s3.amazonaws.com/nunakixuma/radefapi.pdfIn PDF document text
    • https://s3.amazonaws.com/bulikowexunepov/10609189048.pdfIn PDF document text
    • http://lutuxulumoxi.rf.gd/universal_vpn_app_apk.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlTibetanIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012442.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12442 7360 bytes
SHA-256: 38a7940a386c9a5301bdd376e8f0e892b4a0c729159ccae7c144cef57240443a
font_01_sfnt_off00013701.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13701 6548 bytes
SHA-256: 3d70a6230cff7ad5c45be403877a3e6b8e937b67df8666d17985750ff2451267
font_02_sfnt_off00014dbf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14DBF 5192 bytes
SHA-256: 69884e1207ba7742071f636cb7c60a9f9341b34eb23a2a0d625ca103fca94f94
font_03_sfnt_off00015f4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F4D 10140 bytes
SHA-256: 2b42380f0bf73cfc25a2e6ca006fb56344754a385db224c6489c042b90e3f512
font_04_sfnt_off0001745d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1745D 14472 bytes
SHA-256: 3523c847682c9cc132a745f20fa26465be69024f809b60ca2030111f24960b0d
font_05_sfnt_off00019fea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19FEA 17112 bytes
SHA-256: 41fa749e2faf720abf167997bfe022719c7ba4483e5b2a6e33479b5752a24c3e
font_06_sfnt_off0001b8ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B8ED 3136 bytes
SHA-256: 6bad760be605701fc4afb4502f29d08515da5673d206e51bc75c8b87e88499c1

Open this report in the interactive analyzer, or submit your own file for analysis.