Malicious PDF — malware analysis report

Static analysis result for SHA-256 265d5f2daa230bab…

MALICIOUS

PDF

82.4 KB Created: 2021-04-24 19:54:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a8bd031dae410576c683349d4fac4d2c SHA-1: 93789459d9e4de63b1c24d58ce4508cc726bd3bb SHA-256: 265d5f2daa230bab6d6495aaaed06572e226b390922d72b2d5c5a79c599c23b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://botokaw.ru/strik?utm_term=shoei+neotec+2+cheek+pads+31mm', which is likely a phishing lure or a distribution point for further malware. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, further supporting the idea of a web-based lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=shoei+neotec+2+cheek+pads+31mm
    • http://eurostore.info/maligemabavatund5byi.pdf
    • http://sadipize.scienceontheweb.net/belajar_jawi.pdf
    • http://zuxemesemubozo.mywebcommunity.org/critical_analysis_definition.pdf
    • http://gedadekenoz.mywebcommunity.org/17645489960.pdf
    • http://italysummer.fun/seiki_se39uy04_service_menu1h0li.pdf
    • http://bosemefawixuwov.mypressonline.com/baker_s_yeast_production_process.pdf
    • http://erogan-encolumbia.site/jokipebosedunil3jqmd.pdf
    • http://zoomita.fun/pupiporalumumirifovotediys272.pdf
    • http://cadenalia.com/cs_lewis_the_great_divorce_youtubejnc0v.pdf
    • http://static-get.top/python_2._7_exe_for_windows_10wryz9.pdf
    • http://successinyourlif.website/how_do_you_reset_a_lacrosse_atomic_clockmf82w.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/af463d9a-ce70-4980-a5e9-e38badc2dbee/59983112913.pdf
    • http://girofili.myartsonline.com/the_writers_journey.pdf
    • https://s3.amazonaws.com/nademopor/wesuzosap.pdf
    • https://uploads.strikinglycdn.com/files/e36adb34-a258-404e-aa84-00144f007b4d/insurgent_original_book_cover.pdf
    • http://xolavozezimodan.onlinewebshop.net/jozugakekenumebapiko.pdf
    • https://s3.amazonaws.com/fezenur/16148706293.pdf
    • https://s3.amazonaws.com/napoledunadigo/57206358713.pdf
    • https://uploads.strikinglycdn.com/files/f3d10f95-b914-4a0f-9347-d379d72fd51b/nivajusalovasobegoleva.pdf
    • https://s3.amazonaws.com/salosibejodod/94717861848.pdf
    • https://uploads.strikinglycdn.com/files/ea2c6411-ee65-4998-a876-216111b54570/unitypoint_urgent_care_west_des_moines_iowa.pdf
    • https://s3.amazonaws.com/wuvepilamamuse/94057767394.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea56.bin
3f817d7391205109a9da48ed1a75e76668ba7209c47bc2f52c270626d5873533		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA56 5700 bytes
font_01_sfnt_off0000fda5.bin
6ef01fe5f1087e0db9bae46270d0d4c3a623de2e8ccd8b0e8808415333b48506		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA5 12980 bytes
font_02_sfnt_off000126f7.bin
8e14c86fc3b8b6015485dd2dc55534c1d318ca6e4ce8cbcdacfdcd8f7eee4c6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126F7 16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.