Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b696e5e9065e314…

MALICIOUS

PDF

79.6 KB Created: 2021-04-08 09:07:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 20f4d68e9681f496618366970d8f54d0 SHA-1: d2740af4e2bcd4b3f23ba10667e7d52002088813 SHA-256: 6b696e5e9065e314262980909195ca5037b70d45baaad36171cd8f4d0aa6567f
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1539 Steal Application Data

The sample is a PDF document flagged by ClamAV as a phishing trojan. Heuristics indicate it uses an MFA or one-time-code harvesting lure, consistent with credential phishing. The embedded URL https://botokaw.ru/strik leads to a page that likely hosts the phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=why+does+my+face+turn+red+during+pregnancy
    • https://mafetoga.weebly.com/uploads/1/3/0/8/130874134/dalapelujumilu-nujidolexilebu-vesizowumij-nipapim.pdf
    • http://vivuwolijerina.iblogger.org/behavioral_psychology_textbook.pdf
    • http://zewenidasi.iblogger.org/37817532246.pdf
    • http://walifevapeju.22web.org/discrete_fourier_and_wavelet_transforms.pdf
    • http://hytri.com/3880547138i7vqe.pdf
    • https://lugewulisafope.weebly.com/uploads/1/3/4/3/134311751/6780210.pdf
    • http://egosikenclub.com/boy_scout_emblem4yhav.pdf
    • https://mapatujil.weebly.com/uploads/1/3/1/4/131454051/tuvasimakilenebod.pdf
    • https://static.s123-cdn-static.com/uploads/4389366/normal_5ff62c7d342dc.pdf
    • https://toxerixefekivi.weebly.com/uploads/1/3/5/2/135296371/b5a42bedb4abe8.pdf
    • https://cdn-cms.f-static.net/uploads/4383804/normal_60175a60d0d7c.pdf
    • https://static.s123-cdn-static.com/uploads/4411245/normal_5fe5e98d25cb5.pdf
    • https://cdn-cms.f-static.net/uploads/4489607/normal_6011c8170f91e.pdf
    • http://pinerapidsrr.com/onenote_tutorial_2016a2uph.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fiwusinuba.rf.gd/mupuxupo.pdf
    • http://zitoxilafeguxu.rf.gd/xopesizugufu.pdf
    • https://uploads.strikinglycdn.com/files/5502c6c8-d076-4b9e-bee6-e0ed38f7e1a0/xizirinu.pdf
    • https://uploads.strikinglycdn.com/files/ff94b6ae-03ff-4cb2-a66e-8fd12b646b12/79749512211.pdf
    • http://garubokiboja.rf.gd/2433099213.pdf
    • https://uploads.strikinglycdn.com/files/cd83b2ea-f081-420c-a88f-27ada22b971b/2014_amc_10a_answers.pdf
    • https://uploads.strikinglycdn.com/files/81598925-4a08-4a8a-8aa7-cddbc03f463c/behenian_fixed_stars_astrology.pdf
    • http://bikawojesagoso.rf.gd/16733913511.pdf
    • http://xoxejafomi.rf.gd/6442929616.pdf
    • https://uploads.strikinglycdn.com/files/0a6d1147-d501-4a07-8a4c-1e6a5b958ea4/troy_bilt_horse_tiller_pto_attachments.pdf
    • http://devepovamijube.epizy.com/noberedaxap.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f719.bin
893bb4c871c3476d3e9add79c39d77f7486fbdfc69590d90cec4657ea7b4f0f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF719 5652 bytes
font_01_sfnt_off00010a40.bin
3c36562f75fbeb29581d250f90becfb15fca9fea111347ed71e9a92b97db480e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A40 11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.