Malicious PDF — malware analysis report

Static analysis result for SHA-256 7589f0bad7ebdc7e…

MALICIOUS

PDF

71.5 KB Created: 2021-03-31 15:51:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f54935491d1b6e1712a5509059f29bdb SHA-1: d3c71d6988ef144dcbcd9f78c4c9fd6e671e3db1 SHA-256: 7589f0bad7ebdc7e8e30e6cfdea22eafb3e17e34f8664b5ad49e2de07dbe18d4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'botokaw.ru', which is likely used to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, appears to be a lure related to song downloads, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=autograph+songs+tamil++masstamilan
    • https://cdn-cms.f-static.net/uploads/4372382/normal_604f01956b326.pdf
    • https://cdn-cms.f-static.net/uploads/4469631/normal_603b3d07b5977.pdf
    • https://cdn-cms.f-static.net/uploads/4386594/normal_6012c4d0d764e.pdf
    • https://cdn-cms.f-static.net/uploads/4374545/normal_604cc60252bf7.pdf
    • https://cdn-cms.f-static.net/uploads/4393204/normal_6028e4bed8ab3.pdf
    • http://copyrightsupportforlnstagram.com/best_nike_air_force_1_custom_designseiwkv.pdf
    • http://boxberry-24.cc/traincontroller_9_gold_serialcdlz2.pdf
    • https://cdn-cms.f-static.net/uploads/4369911/normal_600bae90daa65.pdf
    • https://static.s123-cdn-static.com/uploads/4366050/normal_5fcc3afb01322.pdf
    • https://static.s123-cdn-static.com/uploads/4475729/normal_60053ffdad9ea.pdf
    • http://mon-cmbretagne.best/vojovakegavoneh13dg.pdf
    • https://cdn-cms.f-static.net/uploads/4417139/normal_600bcaa244641.pdf
    • http://italywow.space/755227065783eebh.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kewuxejikiwe/85487859862.pdf
    • https://uploads.strikinglycdn.com/files/cba1e669-3a0e-40cd-9b65-192fdfbd2e6e/5297930097.pdf
    • https://uploads.strikinglycdn.com/files/b7b2a6a1-2505-405e-9e4b-8b4e07b5a435/the_republic_of_tea_organic_immunity_supergreen_tea_-_36_bags.pdf
    • https://s3.amazonaws.com/wolina/free_animation_software_for_windows_7.pdf
    • https://s3.amazonaws.com/juvuraguvutoxif/zujopafuj.pdf
    • https://s3.amazonaws.com/safenalavojuwu/the_dugong_sea_cow_ielts_reading_answers.pdf
    • https://uploads.strikinglycdn.com/files/936b6fb2-3d0c-4c99-b2b4-bd0aa0a86f88/ps3_3_beeps_eject_button.pdf
    • https://s3.amazonaws.com/godewumazek/tamufuridelokimug.pdf
    • https://s3.amazonaws.com/bejokazemur/earring_box_template.pdf
    • https://s3.amazonaws.com/vuterijoze/penojoxurufukerolozezu.pdf
    • https://s3.amazonaws.com/pusori/bikini_body_guide.pdf
    • https://uploads.strikinglycdn.com/files/0e6b05b9-55da-4046-844c-2d9aba18e4e7/wuxuxigarepusasunoju.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbe1.bin
c848a7e76213569f601c5193e386ee96934ee1b75df9a8b150453e11836bb880		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBE1 5224 bytes
font_01_sfnt_off0000ed7f.bin
f21792beeae86782d4ba0e782bb727a91fd83daa90357e57dcdee25dcd7385b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED7F 10228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.