Malicious PDF — malware analysis report

Static analysis result for SHA-256 17bf9ffd3da15362…

MALICIOUS

PDF

97.2 KB Created: 2021-03-23 03:18:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee048371f50a075b5e7cafa32b53375b SHA-1: b4130dd9c6ca1268870c2676d70a94d0d7bb9dee SHA-256: 17bf9ffd3da15362860ff1e1aae329abadbb537aa8fb5c13f3036626700aa7ed
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to 'botokaw.ru', which is a strong indicator of a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=dulces+mentiras+amargas+verdades+3+decisiones+pdf
    • https://cdn.sqhk.co/jezuleku/B35hfhc/wikim.pdf
    • https://cdn-cms.f-static.net/uploads/4406820/normal_60591e4237f8c.pdf
    • https://cdn-cms.f-static.net/uploads/4448986/normal_602a29dfe5c91.pdf
    • https://cdn.sqhk.co/kewebogi/jQHbJFl/notes_apple_for_windows.pdf
    • https://cdn.sqhk.co/zoribakim/c6PYue3/50239033995.pdf
    • https://cdn-cms.f-static.net/uploads/4427820/normal_60586ca9258b7.pdf
    • https://cdn.sqhk.co/pidikuso/ophdjjf/55855596342.pdf
    • http://solent.bar/80492101712dzv3a.pdf
    • https://static.s123-cdn-static.com/uploads/4461761/normal_5fe2c34465f9a.pdf
    • https://static.s123-cdn-static.com/uploads/4446286/normal_5fcf20a6d3365.pdf
    • http://lerob.info/how_to_read_love_tarot_with_playing_cardsrfgob.pdf
    • https://static.s123-cdn-static.com/uploads/4478928/normal_5fc69e24b8794.pdf
    • https://cdn.sqhk.co/webaxepibi/iQhcojf/ufc_251_news_now.pdf
    • https://static.s123-cdn-static.com/uploads/4371265/normal_5fca864e4c167.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/d61c154c-e765-4b08-a067-d8ad324c3090/un_curso_de_milagros.pdf
    • https://uploads.strikinglycdn.com/files/9d874387-68f9-41ac-9c20-a9a39c7cbe0e/maytag_2000_series_dryer_belt_replacement.pdf
    • https://s3.amazonaws.com/tajimipojimo/cabal_mobile_apk_obb.pdf
    • https://s3.amazonaws.com/dupula/main_beach_north_stradbroke_island_surf_report.pdf
    • https://uploads.strikinglycdn.com/files/c3c68eca-a58b-4b67-a6f2-5d2c5e261baf/3439113986.pdf
    • https://s3.amazonaws.com/gonima/asco_guidelines_non_small_cell_lung_cancer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012bc9.bin
a6a7fd9089672d570247da072590638c7eca4c720234d58add887923c7f7ffb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BC9 5580 bytes
font_01_sfnt_off00013eb5.bin
6f9d20338a9162556a84fd15e6524f637b93d4720802713182156989671f634c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EB5 13132 bytes
font_02_sfnt_off000168c3.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x168C3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.