Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d7a31eea724641f…

MALICIOUS

PDF

151.4 KB Created: 2021-04-25 14:44:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f4a26b5c5e9f76f04dac31434375ed34 SHA-1: 02dd4b8eca6dd61b272fdb3bc5b0d9f170e61b03 SHA-256: 7d7a31eea724641f6d63493a66cfaced98a02240e4faf14ace58fcfdbf09cf02
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'botokaw.ru', which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to a 'Sherlock Holmes book review'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=sherlock+holmes+book+review+pdf
    • https://cdn.sqhk.co/duwutawuna/f0VhiGP/vorufone.pdf
    • http://fuvufurewuf.iblogger.org/zejovixit.pdf
    • https://cdn.sqhk.co/tefozakozup/yyidAnZ/how_to_get_free_200_robux.pdf
    • http://tamazilewuviden.22web.org/garmin_gps_76_user_manual.pdf
    • https://cdn.sqhk.co/jogepirar/ja7hiwJ/guitar_recording_sounds_muddy.pdf
    • https://cdn.sqhk.co/purorenutuw/gaigrgc/helter_skelter_manga.pdf
    • http://tafakiduwav.scienceontheweb.net/39940234857.pdf
    • https://cdn.sqhk.co/soziwariru/PjdHigy/ramof.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/54a5ca44-9b25-4063-b7f6-f72952245ee8/what_are_latin_based_words.pdf
    • https://s3.amazonaws.com/sorapobuk/70488313949.pdf
    • http://wawutanow.epizy.com/zaxerotexelevi.pdf
    • https://uploads.strikinglycdn.com/files/594cf431-b0b5-428e-9aaf-1d7cb2db729c/what_are_the_theories_of_language_acquisition.pdf
    • https://uploads.strikinglycdn.com/files/d22319cf-cbd8-44ee-bb01-6d50a37f4620/bijomegavibasedakewi.pdf
    • https://uploads.strikinglycdn.com/files/f7c1c4a9-8674-43fe-b1f5-8937b57de78e/gumupozuzep.pdf
    • https://uploads.strikinglycdn.com/files/751012d9-2be5-47eb-a69b-bf70762f662a/woparogufadobewunaf.pdf
    • https://s3.amazonaws.com/sesafefanulokam/havaianas_sizing_guide.pdf
    • http://xemigososefof.atwebpages.com/barrier_option_pricing.pdf
    • https://s3.amazonaws.com/gizonukorad/how_children_succeed_summary.pdf
    • http://bitesokilok.epizy.com/vilat.pdf
    • https://uploads.strikinglycdn.com/files/da80d95a-0d46-4189-8a39-cb363ffb47a3/windows_10_all_in_one_iso_x86_x64_activated_free_download.pdf
    • https://s3.amazonaws.com/lowuwofuxali/how_to_read_company_financials_for_investing.pdf
    • http://kosinatatit.rf.gd/48040416801.pdf
    • https://s3.amazonaws.com/jijumupade/experian_free_credit_report_usa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002112f.bin
df2979f5cd470a4ba3fd65f38ec7bf09709405556291ffce3fa3e4a7c14453ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2112F 5644 bytes
font_01_sfnt_off0002244a.bin
4f66321ef042fc51b47d80e6ad06a7a4e940e89d8b05c1e807d5db18110cbfd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2244A 13556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.