Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ed4f59d7109d320…

MALICIOUS

PDF

78.6 KB Created: 2021-03-26 15:20:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: de4772f60684703bfa0e9350dd2c959f SHA-1: 1a20df2481d75366b3adb76a54afed177fc979e6 SHA-256: 5ed4f59d7109d3208856e91c17e58a44f362511a57122783784c4c642a0f1926
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text related to 'verification of assets and liabilities in auditing notes pdf', likely a lure to disguise the malicious nature of the file. The primary attack vector appears to be directing the user to external URLs, such as https://botokaw.ru/award?keyword=verification+of+assets+and+liabilities+in+auditing+notes+pdf, which are likely hosting malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=verification+of+assets+and+liabilities+in+auditing+notes+pdf PDF link annotation
    • http://tofugezupeb.mygamesonline.org/armed_robbery_in_nigeria.pdfIn PDF document text
    • http://krym.today/86259992225cofn.pdfIn PDF document text
    • http://feelslike35.com/how_to_study_for_your_phromwe0.pdfIn PDF document text
    • https://cdn.sqhk.co/nexuliwadi/DmyAjgD/magic_mod_minecraft_mcpe.pdfIn PDF document text
    • http://graatorama.space/lenovo_ideapad_3_14_inch_4gb_ramd5ncm.pdfIn PDF document text
    • http://pogadai.xyz/tupperware_rice_cooker_microwave_instructionsyvwep.pdfIn PDF document text
    • https://cdn.sqhk.co/sisagoku/fLoUFWC/gufimufiwuxabawin.pdfIn PDF document text
    • http://kamini33.ru/wulutufamixiwukines7d4o.pdfIn PDF document text
    • https://cdn.sqhk.co/dowepigakaw/iahjgck/cytosine_structure_and_properties.pdfIn PDF document text
    • http://findssldz.xyz/804535374089b6ob.pdfIn PDF document text
    • http://cashtanks.fun/what_does_the_chinese_constitution_say_about_secessionl41wm.pdfIn PDF document text
    • http://forkidsshop.online/sumegetijuvizusaxurelouzf99.pdfIn PDF document text
    • https://cdn.sqhk.co/puvubuzu/3OLjyjg/kotokiseko.pdfIn PDF document text
    • http://bukuminuwakub.mypressonline.com/past_simple_irregular_verbs_exercises_elementary.pdfIn PDF document text
    • https://cdn.sqhk.co/raxoxawupej/CkgcjeS/76305868462.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bopuxosavubare/what_is_the_meaning_of_elective_lscs.pdfIn PDF document text
    • https://s3.amazonaws.com/woneketelak/turafog.pdfIn PDF document text
    • https://s3.amazonaws.com/divelikubapiwaj/83850448838.pdfIn PDF document text
    • https://s3.amazonaws.com/dobikasukavu/national_geographic_abu_dhabi_live_android.pdfIn PDF document text
    • https://s3.amazonaws.com/daraniwekamidir/33797139193.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/65183674100.pdfIn PDF document text
    • https://s3.amazonaws.com/fixararololu/bevele.pdfIn PDF document text
    • https://s3.amazonaws.com/nojemi/55941597374.pdfIn PDF document text
    • https://s3.amazonaws.com/vavapekadoliti/16355256237.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4E4 5428 bytes
SHA-256: cbfdb4854419e159f86bec61197d35a77dfb4291d653201f85800e42190f5385
font_01_sfnt_off00010768.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10768 10976 bytes
SHA-256: 55592f0af0fae64b77ba68b4d8152393b157bbcf7599609acff8c14ae11844d7

Open this report in the interactive analyzer, or submit your own file for analysis.