Malicious PDF — malware analysis report

Static analysis result for SHA-256 1faa821f8db749f1…

MALICIOUS

PDF

84.2 KB Created: 2021-03-17 16:56:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2ee513548293f6dd175b8329629a94b6 SHA-1: 18ad0a9ec6659e63c6b402f79bc486dcfd2c3346 SHA-256: 1faa821f8db749f1ee7cfff17808f346c569e5053e3ea19f3e4917e6e6eae97d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and is flagged as malicious by ML classifiers and ClamAV. The embedded URL, 'https://botokaw.ru/strik?utm_term=whirlpool+duet+steam+washer+fault+codes', is likely the primary mechanism for delivering a malicious payload or redirecting the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'Whirlpool duet steam washer fault codes', suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=whirlpool+duet+steam+washer+fault+codes
    • https://cdn-cms.f-static.net/uploads/4481059/normal_5fd09fdec6d76.pdf
    • http://jekeluxuto.mywebcommunity.org/14368346851.pdf
    • https://cdn-cms.f-static.net/uploads/4481059/normal_60323995770fe.pdf
    • https://cdn-cms.f-static.net/uploads/4366020/normal_5fd7c13a14265.pdf
    • http://manapuzasupin.sportsontheweb.net/curso_completo_de_apicultura_layens.pdf
    • http://nuwojukow.mygamesonline.org/apollo_tyres_annual_report.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/65b1681b-0fa8-442e-9af6-0f599b4bbcff/lozitaxeraruxidiwil.pdf
    • https://uploads.strikinglycdn.com/files/f8ee11a4-4088-423b-933b-6fdaff02cf14/ledavuduwepumovidokije.pdf
    • http://kavibajegis.onlinewebshop.net/how_to_get_gamestop_coupons.pdf
    • http://tefetuzuzip.myartsonline.com/futexukagumune.pdf
    • https://uploads.strikinglycdn.com/files/d55e38a0-af8c-4488-a35f-173238ca219b/the_other_side_of_heaven_2_full_movie_123movies.pdf
    • https://uploads.strikinglycdn.com/files/6c420215-4e24-4fb5-aab3-eca61b4289be/vusugozolilokagitu.pdf
    • http://gusizozubamu.epizy.com/maths_questions_for_ssc.pdf
    • http://dojafeduzig.myartsonline.com/actual_test_300_101.pdf
    • http://teruwisap.epizy.com/nekopakiwedovulizuvef.pdf
    • https://uploads.strikinglycdn.com/files/9dea2463-4af2-4ad5-aad1-3b15870db0a9/emerson_32_inch_tv_wall_mount_screws.pdf
    • https://uploads.strikinglycdn.com/files/fffa159d-b8a2-45fe-afb0-f279027d85d3/84742305282.pdf
    • https://uploads.strikinglycdn.com/files/e4bf4eee-277e-448b-836e-0e8472dd7e42/terupesisidisemu.pdf
    • http://figiwulowiwumoj.epizy.com/30326278191.pdf
    • http://nuvefugokudob.epizy.com/3833948896.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a98.bin
52b6a0a228252f8e3f2d7e111101c00dae4959cde5468ab7843a4694eec89648		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A98 5500 bytes
font_01_sfnt_off00011d39.bin
6a674b765a40b8aaa59460f5a80ee23f7938c0fe66261f9f4b97d07147dcb1f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D39 11272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.