Malicious PDF — malware analysis report

Static analysis result for SHA-256 631e073d58f2b489…

MALICIOUS

PDF

108.2 KB Created: 2021-04-04 14:55:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1e21928eb0ae794dec9c62e0ad050770 SHA-1: 77a10e70bc98b618b9ae0f0eb005a015dc672178 SHA-256: 631e073d58f2b489ce83b37b6df7d370218c76e1e8ece0c09066aec7d5e97535
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'botokaw.ru', which is likely a malicious domain used for phishing or distributing further malware. The document body, though heavily obfuscated, suggests a lure related to 'basic emotions list pdf'. No scripts were extracted, but the presence of external URIs and the malware detection indicate a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=basic+emotions+list+pdf
    • https://cdn.sqhk.co/feguzuvubut/igUjhnQ/lost_temple_of_zios_animal_jam_play_wild.pdf
    • http://ttttrrrr.space/bawulolilevizp2are.pdf
    • http://azakalaza3.xyz/1441316940rgjmb.pdf
    • http://copyrightproblem.com/2827806911nzliz.pdf
    • https://cdn.sqhk.co/givogaduta/jegjHhj/89716161943.pdf
    • https://cdn.sqhk.co/xavexapoxiv/jjgj2hi/96882192998.pdf
    • http://bimoluk.iblogger.org/what_is_the_length_of_land_and_coastal_boundaries_of_india.pdf
    • https://cdn.sqhk.co/kominepoli/hf0geFd/nuclear_warfare_nuclear_war_movies.pdf
    • https://cdn.sqhk.co/genizataxom/A7Hogin/netter_anatomy_coloring_book.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/duzexefemosaxe/fiwigefenejurujozavivilun.pdf
    • https://s3.amazonaws.com/jukoxisojow/21072170537.pdf
    • https://uploads.strikinglycdn.com/files/dd04f44e-938c-4c5a-aaca-dcb09fb66bb4/irobot_roomba_677_replacement_parts.pdf
    • http://dinilemave.epizy.com/gejigumud.pdf
    • https://uploads.strikinglycdn.com/files/7fac6bc7-5ad0-487d-8673-93d7d4eb793e/ralph_waldo_emerson_transcendentalist.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/amazon_fire_hd_8_10th_generation_user_manual.pdf
    • https://s3.amazonaws.com/jusuberu/five_oceans_of_the_world_worksheets.pdf
    • https://s3.amazonaws.com/fajixe/68381651859.pdf
    • https://s3.amazonaws.com/jewizopukuni/77224149400.pdf
    • https://s3.amazonaws.com/zesixefe/81497401287.pdf
    • https://uploads.strikinglycdn.com/files/52d0db3a-9077-4e6c-a8fb-1bd2cebd87cc/64976530294.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015577.bin
0e996613dafb7684f1e4c81cf8f570a1bf2747ca4032c5f8d1579a909f8643cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15577 5256 bytes
font_01_sfnt_off0001674d.bin
66c26a7b2f065e277c5f068fa16d6e234e6b57740ff799f4996d9d9e886b1f05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1674D 11396 bytes
font_02_sfnt_off00018dea.bin
cd24fd219253d520e42d97086efbcbd324ca96e25bcc4d23f416e9ab54c05ec1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18DEA 16208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.