Malicious PDF — malware analysis report

Static analysis result for SHA-256 2552bc0b2e46a2f5…

MALICIOUS

PDF

88.1 KB Created: 2021-03-16 03:54:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: fc01bb96ec73902d4c92cc7ec6caf05a SHA-1: b8a73e232f45c7796212a9bf8e5f5f12e3f139bb SHA-256: 2552bc0b2e46a2f5c10f9428867454cc338b2e1f295403e02333dbb46c8545e8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'botokaw.ru', which is likely intended to redirect the user to a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to trick the user into visiting a compromised or malicious web resource, consistent with phishing or malware distribution tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=instagram+pic+er+online PDF link annotation
    • http://findssldz.xyz/email_writing_template_examplesr3m9e.pdfIn PDF document text
    • https://cdn.sqhk.co/sakiforivona/62smhd8/stickers_for_messenger.pdfIn PDF document text
    • http://1s.london/zuzaxwz7o5.pdfIn PDF document text
    • https://cdn.sqhk.co/bimonabozo/j6Mgdgi/fixoladuf.pdfIn PDF document text
    • http://fijubigatusurov.scienceontheweb.net/furiliguriwob.pdfIn PDF document text
    • https://cdn.sqhk.co/fuperule/ii6C9jg/fifamatononorusujodutekuz.pdfIn PDF document text
    • http://vopukisavenif.medianewsonline.com/kijivutotas.pdfIn PDF document text
    • http://complect-tech.ru/zosogafusugmf8xu.pdfIn PDF document text
    • https://cdn.sqhk.co/feduminaro/aUrgdie/carboline_carbomastic_15_product_data_sheet.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/falejogajir/43468482208.pdfIn PDF document text
    • https://c20a02f1-eded-46de-afbf-2d7328e03b26.filesusr.com/ugd/c6fd25_c64a5333408a40a68157d6632dd1498a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gusule/bolukosatefuriki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/457b9f18-d99d-4e8d-ac62-e74c1e1d3f89/vuleg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfe57ba0-eb1d-4d26-9168-7462690b1932/which_of_the_following_is_not_an_example_of_a_nonfiction_text.pdfIn PDF document text
    • https://s3.amazonaws.com/juduk/chori_chori_song_salman_khan.pdfIn PDF document text
    • http://dogiwexor.myartsonline.com/adverbs_of_time.pdfIn PDF document text
    • https://s3.amazonaws.com/wizomoravazub/program_samsung_tv_remote_for_lg_blu_ray.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f3867c8-b7e5-4303-9bd3-8ae040bb3bf2/dakeve.pdfIn PDF document text
    • https://3fb740b9-71d8-4183-8edb-de11b68c0a29.filesusr.com/ugd/1fbf8b_296e70f1df004951a2d1df29743105ea.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/549278f3-daec-4669-9448-a38ea256f0b5/2454762351.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad261a3c-ab3e-4f10-abfb-9776c5b983f4/napetuvesenujatepimo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010423.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10423 5192 bytes
SHA-256: 2af39d1407a2082b3ac1d204be829a91fd6615de45ce771bb3e4cb58b51f471f
font_01_sfnt_off000115b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115B8 11584 bytes
SHA-256: 17c2f66cf49537a6341fe9f22385cfd410972a6cee47d202668813d875369375
font_02_sfnt_off00013d62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D62 16296 bytes
SHA-256: 8209c5fc27800dad91b79bdc1d2542939faa66d1b2f519a8f9f1b913071849a2

Open this report in the interactive analyzer, or submit your own file for analysis.