Malicious PDF — malware analysis report

Static analysis result for SHA-256 07428188af3f9a39…

MALICIOUS

PDF

81.6 KB Created: 2021-03-17 20:48:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58527069559db7997463572a19cafabb SHA-1: 3a0e25d327e788c663e6c43815d582a45ad74c94 SHA-256: 07428188af3f9a39369ae03395194f11a5d9430df4e4d49e21febfa89ea142d6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. It contains an embedded external URI pointing to 'https://botokaw.ru/strik', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to reference product details, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=sodastream+fizzi+one+touch+glass+bottles
    • http://stikc.xyz/wuxin_the_monster_killer_season_3_review2re5r.pdf
    • http://lessonsonline.site/565205116835r1rj.pdf
    • http://nubolats.xyz/pedunu5obrx.pdf
    • https://cdn.sqhk.co/nolagutotato/ihijevE/25900065038.pdf
    • https://cdn.sqhk.co/sujubowip/jm4mhIn/41034356643.pdf
    • https://cdn.sqhk.co/xavaxonad/jiifjao/53235459703.pdf
    • https://cdn.sqhk.co/jawuraxexije/viigel0/ifttt_alexa_myq.pdf
    • http://pemufosapakem.mypressonline.com/cuisinart_keurig_troubleshooting_descale.pdf
    • https://cdn.sqhk.co/tudenireso/fQw9aje/pukinukemufexabidasuzo.pdf
    • http://pexawegowe.mywebcommunity.org/monitoring_and_evaluation_notes.pdf
    • http://i12tws.website/64489590459j06i0.pdf
    • http://irisca.online/rental_car_agreement_hertz_stockl0vok.pdf
    • http://kigajekuterol.iblogger.org/snes_cheat_codes_chrono_trigger.pdf
    • http://kamini33.ru/procreate_drawing_app_tutorial8dbaw.pdf
    • http://phrensy.co/32992591299snpxq.pdf
    • http://potuxoposutu.medianewsonline.com/what_is_the_best_interior_design_software_for_mac.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/b8cb6e66-0d70-4a88-a1e1-3f15023c2515/pilozun.pdf
    • https://uploads.strikinglycdn.com/files/702e037c-d3a5-4bfb-86b8-fea31b712afa/fender_champion_40_amp_used.pdf
    • https://uploads.strikinglycdn.com/files/95befdbc-c211-466e-882f-734e3a7a0351/wopidixupobume.pdf
    • http://temodorofeg.atwebpages.com/adoration_saint_sacrement.pdf
    • http://tutegijuvejok.epizy.com/bright_starts_swing_assembly.pdf
    • http://pubexet.rf.gd/what_is_the_job_outlook_for_technical_writers.pdf
    • https://uploads.strikinglycdn.com/files/87f897bc-3806-46cc-b5a1-39679085bc43/how_to_learn_cashier_work.pdf
    • http://duxejuxaxeze.epizy.com/nugavibasazapugetiwufogu.pdf
    • https://uploads.strikinglycdn.com/files/c9ef2c7a-04e8-4883-94e9-1503a4053b47/msi_geforce_gtx_970_gaming_4g_vs_gtx_1060_6gb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f27d.bin
cc43e0d7f5620e379a49f2b1542514ea4972cefe4dbb5bda7a178a7f2c257d41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF27D 5608 bytes
font_01_sfnt_off00010565.bin
413dff8149da17a43fc9b0b7e4e388e0c678822e6a85997ce4056e6c6ccbab53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10565 10692 bytes
font_02_sfnt_off000129ff.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129FF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.