Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c2e74122fb919b6…

MALICIOUS

PDF

84.2 KB Created: 2021-04-13 12:51:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b63b850cb1ea6504ef2aebeab8820781 SHA-1: 2206176210f4bc8afc8f643d96c16ac830025126 SHA-256: 8c2e74122fb919b663710a78265461224961c880ba63601641efee0993a736bb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'https://botokaw.ru/strik?utm_term=excel+vba+range+value+value2', which is likely part of a phishing lure or malware distribution chain. The document body, though heavily obfuscated, suggests a context related to Excel VBA, further supporting a phishing or social engineering attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=excel+vba+range+value+value2
    • https://static.s123-cdn-static.com/uploads/4458618/normal_6002fe2b51230.pdf
    • http://tuxodoj.22web.org/75404359276.pdf
    • https://cdn-cms.f-static.net/uploads/4483623/normal_60673d5c03c29.pdf
    • http://lovefoxesi.iblogger.org/95707474458.pdf
    • http://jirapunobos.22web.org/zilokeziraj.pdf
    • https://cdn-cms.f-static.net/uploads/4481515/normal_60510e976e7c2.pdf
    • https://cdn-cms.f-static.net/uploads/4365600/normal_602906a6194fe.pdf
    • https://cdn-cms.f-static.net/uploads/4490738/normal_605f19b6024de.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tikoweravisixu/balafij.pdf
    • https://s3.amazonaws.com/tixeligufokup/sample_narrative_report_in_brigada_eskwela.pdf
    • https://uploads.strikinglycdn.com/files/91946cb6-9188-420e-9c2f-40cd9c9830dc/barnett_wildcat_c5_quiver.pdf
    • https://uploads.strikinglycdn.com/files/223e49da-36cb-4516-994f-d75542425490/94531724439.pdf
    • https://uploads.strikinglycdn.com/files/c55fb143-eff9-4365-a174-8d696e95610f/wofen.pdf
    • http://godimodasixor.rf.gd/fedizozurogo.pdf
    • https://1261df91-4e32-40b2-8b8a-4050d3c54cbb.filesusr.com/ugd/df69c1_632e19801dc447e9b0372aeb86862e03.pdf?index=true
    • https://uploads.strikinglycdn.com/files/653520da-a5c9-416c-aea7-1c4f3e000375/32999361136.pdf
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_d78ec89156934487bb4bc1a46deb8b50.pdf?index=true
    • http://vubolax.epizy.com/rafusomorazonarowi.pdf
    • http://noxoxuf.rf.gd/xidij.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000108e1.bin
ed5df9f0c101f32861746131fc68755094045cb77a2ac4dbc3a918e1b7e3555e
pdf-font-stream PDF embedded font (sfnt) at offset 0x108E1 5144 bytes
font_01_sfnt_off00011a82.bin
f4c80d86345d4623a243f4ae1357ac53c6ed79732f1e5b5c091b973fd4522cc2
pdf-font-stream PDF embedded font (sfnt) at offset 0x11A82 11816 bytes