Malicious PDF — malware analysis report

Static analysis result for SHA-256 70c7ce1d246c86da…

MALICIOUS

PDF

77.2 KB Created: 2021-03-18 10:52:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a2dc8bdb84d6d0e428659e5397b42e4a SHA-1: 92171ff7c377fba61e7c3ec96d79c5f8c10d73c2 SHA-256: 70c7ce1d246c86da55a4b40acf4725c4ac9a11560cc566a53783e93ff07d616f
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely contains instructions to open a password-protected archive, a common tactic to bypass gateway security. The embedded URL 'https://botokaw.ru/wix?keyword=street+fighter+4+apk+data' is likely the distribution point for the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=street+fighter+4+apk+data
    • https://static.s123-cdn-static.com/uploads/4408871/normal_60012194bd407.pdf
    • https://cdn.sqhk.co/vasibejovej/hsgJjat/xawixulidoduwinigutur.pdf
    • https://static.s123-cdn-static.com/uploads/4453729/normal_5fec2c05358dd.pdf
    • http://tonerinkstore.com/153041352548imcg.pdf
    • https://cdn.sqhk.co/zudusidesu/hgBhad1/bts_video_call_app_iphone.pdf
    • http://verenica.net/wearever_pressure_cooker_instructionswu0ds.pdf
    • https://static.s123-cdn-static.com/uploads/4387229/normal_5ffeabad98deb.pdf
    • http://modezewop.mygamesonline.org/tenebukorelusupinubomo.pdf
    • https://static.s123-cdn-static.com/uploads/4410211/normal_5ffa444ba1212.pdf
    • https://cdn-cms.f-static.net/uploads/4418987/normal_5fd5fa6789d5b.pdf
    • https://cdn-cms.f-static.net/uploads/4380223/normal_60222307015da.pdf
    • https://static.s123-cdn-static.com/uploads/4443342/normal_5fc9b27461bbf.pdf
    • https://static.s123-cdn-static.com/uploads/4413718/normal_5ffc08ed15643.pdf
    • http://zanartcc.net/harga_charger_samsung_galaxy_tab_2_7.0_originalojfrc.pdf
    • https://cdn-cms.f-static.net/uploads/4369923/normal_5fd134c72507f.pdf
    • https://cdn.sqhk.co/gexedamej/cahfidB/vedonuzevisagiru.pdf
    • https://cdn.sqhk.co/bapisolel/jaK0jax/rawaseje.pdf
    • http://ogranicbio.fun/61164607043va9dq.pdf
    • https://static.s123-cdn-static.com/uploads/4489054/normal_6009a90886ce2.pdf
    • https://cdn-cms.f-static.net/uploads/4476418/normal_6020357c4b8bb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ketabigumowun.atwebpages.com/how_to_start_civil_court_proceedings.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed5c.bin
f5d68c2ed8911320fcd3cd0737028b08b6e43d8824e0b55e30d8d89b3f457383		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED5C 5348 bytes
font_01_sfnt_off0000ff90.bin
cb864c4e035c5c07dee5f5f7bddefa4778f5960c5d96f3ff1de2f3a60671f249		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF90 11848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.