Malicious PDF — malware analysis report

Static analysis result for SHA-256 5dec6135dff9aa74…

MALICIOUS

PDF

137.1 KB Created: 2021-05-05 21:02:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 61cceec026461b3c115ea5f3b3fc3187 SHA-1: db2dad0f5456246801527d9641c43546234806e3 SHA-256: 5dec6135dff9aa74a89b9cf4ee3b51394132451592bc56ddcd05e85c530850b7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, with one specifically pointing to a suspicious domain ('botokaw.ru') and containing a UTM parameter suggesting a lure related to a Honeywell product manual. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a phishing or trojanized document. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristics suggest the document is designed to redirect users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=manual+for+honeywell+rpls730b1000%252Fu+7-day+programmable+light+switch+timer
    • http://zujadise.scienceontheweb.net/acinetobacter_baumannii_2020.pdf
    • https://cdn.sqhk.co/burajugi/hjhjj92/79749315790.pdf
    • https://pebarefilegiz.weebly.com/uploads/1/3/5/3/135325086/4324433.pdf
    • http://erogan-columbia.site/81704458298d7np7.pdf
    • http://nubolats.xyz/christmas_gel_nail_designs_for_short_nailsz0sg0.pdf
    • http://karnaval.host/nozotuzemafemenuzifivurq3ss.pdf
    • http://cherrypimp.online/busudoauqcu.pdf
    • https://cdn.sqhk.co/nukusigemug/fmnmEew/d_d_5e_animal_companion_sheet.pdf
    • https://rumirasikimuzib.weebly.com/uploads/1/3/2/7/132710795/jadupapo.pdf
    • https://virataxutepubom.weebly.com/uploads/1/3/0/8/130874282/96775.pdf
    • http://lnstagramsupportingcenter.com/how_to_reset_ink_pad_epson_l5190vx5i1.pdf
    • http://copyrightshelpcenter.com/jack_and_the_beanstalk_full_story_youtubegl8lv.pdf
    • https://fezagexagowib.weebly.com/uploads/1/3/5/3/135313062/588e07eef3aa3b.pdf
    • http://itravelgr.com/sp_racing_f3_flight_controller_pinoutoyqcs.pdf
    • https://vurovovi.weebly.com/uploads/1/3/4/0/134040995/1008270.pdf
    • https://cdn.sqhk.co/ranofakon/haKcgh5/hit_the_glass_walls.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dobikasukavu/rajolifalavavapej.pdf
    • http://gagugitebuf.atwebpages.com/how_to_test_transistor_using_analog_multimeter.pdf
    • https://s3.amazonaws.com/vifusupegiza/spider_man_homecoming_game_pc.pdf
    • https://s3.amazonaws.com/purixifusipelid/toro_824_snowblower_parts_list.pdf
    • https://s3.amazonaws.com/fekife/rock_band_4_drums_ps4.pdf
    • https://s3.amazonaws.com/tisegovofu/wovuzotefatunikurema.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a5fc.bin
03b77f781b5ad93258f00ed75dd7e27b5be3e99dfa148cdd8c9fa3dd0a6522ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A5FC 2160 bytes
font_01_sfnt_off0001af81.bin
85f4559a09ab1121dd693253f1fc5756953855dd8a367c000db5e7b1c9b46fd7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF81 2884 bytes
font_02_sfnt_off0001b9cc.bin
c53f11840c90712ec0cd0bea8f8285e5149c7a448dd6965802c826d3ee49d6cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B9CC 6416 bytes
font_03_sfnt_off0001cfb3.bin
634d23dc7b8363d71d994480704d2f81dfb89736db1fc48e2706cacfefbbd5ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CFB3 13908 bytes
font_04_sfnt_off0001fd89.bin
55ee31f2b9c575572aca401957c5cf2f3b57b55b1dd57d1bb6d1e144d3512b41		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FD89 16088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.