Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea4637590a6da836…

MALICIOUS

PDF

73.5 KB Created: 2021-05-31 17:04:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 003ce6393437f886769924d15caf790d SHA-1: 212949e6acc9dc3d968e4afc4aa7fdaf037dcb70 SHA-256: ea4637590a6da836f0c2b364a7fee68293b9da83171f7838caf943322688c591
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'bologen.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to educational worksheets.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=igcse+grade+9+math+worksheets PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4410020/normal_60001ffa0e3dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390664/normal_6046257f5b83f.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4373999/normal_60b48f5016abb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383475/normal_601d3d4d486a2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475738/normal_603d4ae1c144a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mumubib.pbworks.com/f/10322901313.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c485d3a-b851-4069-acc4-fae5a8fd5904/char-broil_stainless_steel_4-burner_propane_gas_grill_with_cabinet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc35fc49-41bd-455d-8282-25e3f743cbc1/synonyms_and_antonyms_worksheets_grade_7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f46e2c04-4379-4d71-9c47-6e276a373aac/55048741380.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/666c34b6-28f0-402f-8f7e-d440160860d4/the_chaser_movie_tamil_dubbed_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44c9d852-8c59-4706-a35f-215dcd80f4a9/57890500762.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09803536-5867-4639-bd1c-e82c54d9e05a/10_ejemplos_de_oraciones_con_verbos_no_copulativos.pdfIn PDF document text
    • http://kufujibumufa.pbworks.com/w/file/fetch/144411858/troy_bilt_5500_watt_generator_troubleshooting.pdfIn PDF document text
    • http://mumubib.pbworks.com/w/file/fetch/144413274/spot_report_format_security_guard.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbf8ab34-abe3-44ba-81f4-be895d742eeb/mutual_funds_for_india.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f23b653-a9a3-4189-986e-3850a4ab6ccb/troy_bilt_mustang_xp_50_drive_belt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cba1c46a-9fef-467b-bf30-20592765083a/16288837522.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d071023-d557-4549-8b33-95545c810d4c/what_is_free_energy_change_in_chemistry.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3562c5b8-35fa-4225-a29f-5b115a8d47cc/zilozasibinokuwajedej.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3561dafb-1a06-422f-912e-9657979f673d/halliday_resnick_walker_8th_edition_solutions_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e038.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE038 5568 bytes
SHA-256: d42c93c40e4ef1890d98c9fe596abf529323e3aa5e14a27cbd5b8927aec63680
font_01_sfnt_off0000f310.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF310 11088 bytes
SHA-256: b95a5dbaa4ac02769f964914a08a7ba380ab06dd3b09bf084e5ebb3b8eef64a6

Open this report in the interactive analyzer, or submit your own file for analysis.