Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dd7e896745ab7e4…

MALICIOUS

PDF

105.7 KB Created: 2021-04-08 08:49:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e3b31ba6a3bcd622312add3081ac7d43 SHA-1: 5b07e6796d7b927a6f5c6bf60ca2d922496edecb SHA-256: 4dd7e896745ab7e455da95510e276f8b1361604bd431652c5f98b3ef5d27c4d5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and embedded URLs, with the primary suspicious URL being 'https://botokaw.ru/wix?keyword=7+days+to+die+starvation+guide+reddit'. The document body, though heavily obfuscated, appears to contain text related to the game '7 Days to Die', suggesting a lure to attract users to the malicious link. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=7+days+to+die+starvation+guide+reddit
    • https://cdn-cms.f-static.net/uploads/4386824/normal_601421ebc6c34.pdf
    • http://ig-socialmedia.xyz/dirt_devil_pro_express_vacuum_belthg91c.pdf
    • https://static.s123-cdn-static.com/uploads/4475859/normal_5fcc6dd42fb8f.pdf
    • https://cdn-cms.f-static.net/uploads/4365551/normal_6022e5cc59c13.pdf
    • https://cdn-cms.f-static.net/uploads/4421640/normal_6026ab0f44bcd.pdf
    • http://aycotoro0.xyz/legend_of_heropolis_mod_apk_unlimited_moneys9k7z.pdf
    • https://cdn-cms.f-static.net/uploads/4475582/normal_6040e4c6c0d85.pdf
    • https://static.s123-cdn-static.com/uploads/4416665/normal_5fdcf08e25722.pdf
    • http://in-step.shop/constitutional_law_for_dummies_freeuxm3b.pdf
    • https://cdn-cms.f-static.net/uploads/4467038/normal_602a2e076946f.pdf
    • https://static.s123-cdn-static.com/uploads/4413718/normal_5fe2cb251c993.pdf
    • http://daliadiago.com/65594161022b1l4t.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f6e2a16f-d004-42cd-8f17-0463e090774c.filesusr.com/ugd/c70c35_a56226ca5972448fb9e78e10333d5162.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dec7fa78-6aa1-439a-b1b5-89324f80b699/kalotuw.pdf
    • https://uploads.strikinglycdn.com/files/65cd9347-de12-4506-b932-08a9d9912496/bobaturorebaloxamodob.pdf
    • https://s3.amazonaws.com/tigewibejageju/64827820890.pdf
    • https://uploads.strikinglycdn.com/files/08db4c01-3ee3-47ca-aa36-41552408292b/sony_icf-c1_alarm_clock_radio.pdf
    • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_2f5b5bb3bda449519367a83e83933f17.pdf?index=true
    • https://s3.amazonaws.com/faluzotixupi/nutasefogebiza.pdf
    • https://uploads.strikinglycdn.com/files/bc82b9f1-93b7-4347-846f-c902c38afcf5/98867496684.pdf
    • https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_c97786f74dda43e1905977ae414acf95.pdf?index=true
    • https://s3.amazonaws.com/legenapi/35694248306.pdf
    • https://uploads.strikinglycdn.com/files/7d83a1df-0ab2-435a-8a3f-07ff773423f4/gukofoludageleloniki.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015d2e.bin
1c1b27a73ff86e06e38b25e57ac96d0dc02b04953315f6432b11cb44e9056e70		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15D2E 5108 bytes
font_01_sfnt_off00016ea8.bin
3aff7d6daeb16b134bd902c374ca5580f0602ffc72ed060d22ede62e7168c9bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16EA8 12236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.