Malicious PDF — malware analysis report

Static analysis result for SHA-256 3af737bd77c7a622…

MALICIOUS

PDF

80.7 KB Created: 2021-04-01 14:43:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 89f3b276fcade3e33af385b9f4677959 SHA-1: ea76669182543d5bc3c372f3cedc2863f7d2702d SHA-256: 3af737bd77c7a622f070adc9852134ea2f016f8964129b3f1ea90b8a2f9f90b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'botokaw.ru', which is presented as a timeline related to the Arab Spring. This suggests a social engineering tactic to trick users into visiting a potentially harmful site. No scripts were extracted, but the presence of external URIs and the malware detection indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=arab+spring+timeline+pdf
    • http://gratoramaa.website/roadmaster_bike_partst1d69.pdf
    • https://cdn-cms.f-static.net/uploads/4447460/normal_604fe98c76a42.pdf
    • https://cdn.sqhk.co/penavagalo/eN7ifQs/56500998046.pdf
    • http://profapp.pro/what_is_the_tone_of_how_do_i_love_theec21w6.pdf
    • https://cdn-cms.f-static.net/uploads/4470985/normal_603ce55fbaa29.pdf
    • http://kamini33.ru/pnb_rock_trapstar_turnt_popstar_downloadlgrm1.pdf
    • https://cdn.sqhk.co/zudoputasafe/Xuc8ax5/rudewapujarej.pdf
    • https://cdn.sqhk.co/rezeribevi/hjc9pgi/titebelinik.pdf
    • https://cdn-cms.f-static.net/uploads/4414514/normal_604cd6093d5cd.pdf
    • http://verification-help.business/smithsonian_channel_air_disasterspfmj0.pdf
    • https://cdn.sqhk.co/gotoruzud/gDRjijg/spider_man_vs_venom_drawing.pdf
    • http://sibatike.getenjoyment.net/how_to_iso_certification.pdf
    • http://botefedej.sportsontheweb.net/sumezagomepopapakeropo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/lolaritemukole/18677078081.pdf
    • https://s3.amazonaws.com/zufaxepixiguxax/40322394174.pdf
    • https://s3.amazonaws.com/fosagobomap/lindsay_s_law_test_answers.pdf
    • https://a694a867-b0fa-45cd-b082-7f9abf80b1a7.filesusr.com/ugd/430cb2_a836d0d32db9477884520877f995983a.pdf?index=true
    • https://9a86171b-24d8-4f43-8717-687e75280c8f.filesusr.com/ugd/6234e8_089e09b7d991474083e9ad6a038eabc0.pdf?index=true
    • https://41c240d9-b4af-4f88-8fa4-2a41cce3a287.filesusr.com/ugd/01bc73_85333d4ed8824c4396089874d3b158cf.pdf?index=true
    • https://9e084d23-5bbf-42ad-98e9-fa9200f8584e.filesusr.com/ugd/4f663b_722ead6dfb4746f1af58661ba92bc3c2.pdf?index=true
    • https://s3.amazonaws.com/watajive/21309796973.pdf
    • https://92fa68c6-d088-48c5-94d9-776fe0504fc0.filesusr.com/ugd/5a053b_217eb697b3b54f6eb71c7ffef97dc1de.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f07d.bin
2dba9efc045f32a1117027ec6d592e6c9d4776204de226aef73a6422a6e42d39		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF07D 5168 bytes
font_01_sfnt_off000101e4.bin
df5ab8dd8aafaed5d9a6755c0eee7bcd756c26cfa1e2e149e1cb4ea007f72c69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101E4 11012 bytes
font_02_sfnt_off00012752.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12752 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.