Malicious PDF — malware analysis report

Static analysis result for SHA-256 35b98871aaf65d19…

MALICIOUS

PDF

77.9 KB Created: 2021-03-19 10:43:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75825604071535e81a02db9798c2fa91 SHA-1: 6fcdaf03702b86ef707f3b38c672259df4b95afe SHA-256: 35b98871aaf65d194a2d308d062245d29b98c46f78b2791d5e3ffd5779add047
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'botokaw.ru', which is likely a phishing or malware distribution lure. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a crafted PDF. No scripts were extracted, but the presence of a malicious URI in a PDF is a strong indicator of a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=ballistic+missile+trajectory+pdf
    • http://wofijolusiga.iblogger.org/cg_bsc_nursing_2019_answer_key.pdf
    • http://kozugufasuroti.mygamesonline.org/tokagepujakafubusixebise.pdf
    • http://fiselijuduguge.iblogger.org/bimufowexopujobep.pdf
    • http://senenetikoxikom.22web.org/anne_marie_live_performance_rockabye.pdf
    • http://digosige.mywebcommunity.org/important_characteristics_of_report_writing.pdf
    • https://cdn.sqhk.co/xexisini/UidicUK/rojosa.pdf
    • https://cdn.sqhk.co/sifalavuxozo/ie33jgi/dazulodekuwinemawusoju.pdf
    • http://winokuzovew.iblogger.org/appsheet_dashboard_view.pdf
    • http://lerimofo.mywebcommunity.org/31483529712.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pasazaxara.rf.gd/94101688007.pdf
    • https://368051e9-4199-40ea-b9a2-dc6e6f83cb3b.filesusr.com/ugd/6260fe_ec98825ad15d41039f5f781cfd00a7a2.pdf?index=true
    • https://ed8bc375-cd54-49ab-9ddb-988cb5b2fc3d.filesusr.com/ugd/3f3824_55e4049a9b0d466287e262685abd9fbe.pdf?index=true
    • https://s3.amazonaws.com/bolovopizonuki/how_to_replace_ryobi_trimmer_primer_bulb.pdf
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_fff493bf7ea24618ae0953fcf3c9383f.pdf?index=true
    • http://zivunoked.epizy.com/10467803615.pdf
    • https://47ab6ce1-aee6-4086-a8e7-31fe393d2411.filesusr.com/ugd/afbef4_84c3d7f130c146518c4c2e406f8e5290.pdf?index=true
    • https://6c036dbd-b327-4678-b778-de8a2ee7bb50.filesusr.com/ugd/ed64d2_65b26dd24a3d40ebb537ed33f9cd2774.pdf?index=true
    • http://kisezemewarajox.rf.gd/skyrim_how_to_install_nexus_mods.pdf
    • http://busanezawub.rf.gd/73312131158.pdf
    • https://s3.amazonaws.com/gawabog/duvagubinesezuju.pdf
    • https://s3.amazonaws.com/vefagotoje/call_of_duty_mobile_zombie_mode.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f281.bin
c0da99169da9ad62265775661650a242fc56f7d06bd2e5637449672c5cbd15df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF281 5528 bytes
font_01_sfnt_off00010546.bin
e80e35b0800adaf97d6ebf643f8588aa767edf7f028762fc7cf4dbb3dbcf5160		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10546 10732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.