Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c6dfdf1f4ed9f99…

MALICIOUS

PDF

85.8 KB Created: 2021-03-20 06:46:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50ef67123ef30ca70d4e5bd705d8603c SHA-1: b28b265dd792bc783e14af64dc509c70775ae5a9 SHA-256: 9c6dfdf1f4ed9f992a312ebbbc597594e5bb31e880a6265552079691a09c35c1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as a phishing trojan and ML classifier indicated a high probability of maliciousness. It contains an embedded URL, https://botokaw.ru/wix?keyword=bdo+witch+pvp+guide, which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to a game guide, which is a common tactic for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=bdo+witch+pvp+guide
    • http://profer-opt.ru/how_to_thread_a_bobbin_on_a_montgomery_ward_sewing_machinec1u6u.pdf
    • http://alteramaks.world/suzelemixizubesirez01foy.pdf
    • http://autoport76.online/fapufilategigunakibesaijioi.pdf
    • http://free-at.pro/jujogemamoxojefidugwvpp.pdf
    • http://waludojugemupa.iblogger.org/adjective_clauses_worksheet_with_answers.pdf
    • http://the-glow.ru/rubelusofitabojubelusulorm43s.pdf
    • http://look-hotel.com/rozowewananobujoluulb0.pdf
    • http://goldalbum.ru/how_to_animate_in_procreate_20200b34w.pdf
    • http://maykistore.ru/447766077290u9ac.pdf
    • http://magnifioco.site/hp_officejet_pro_6835_printer_driver_downloadedt91.pdf
    • https://nowesepi.weebly.com/uploads/1/3/1/1/131164229/1517355.pdf
    • https://jorobeperepi.weebly.com/uploads/1/3/1/8/131856290/d4ac4790.pdf
    • https://jikolugoxolij.weebly.com/uploads/1/3/1/3/131379047/rujitezuxubilov.pdf
    • http://jusegoma.22web.org/53762164908.pdf
    • http://eyebrowthreadingdallastx.com/65428772766hrsww.pdf
    • https://tejojapifofomo.weebly.com/uploads/1/3/4/3/134339563/wakukobo.pdf
    • https://gidutuzewefira.weebly.com/uploads/1/3/1/3/131380066/bivipimogogowo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zubikexef.rf.gd/26562031855.pdf
    • https://uploads.strikinglycdn.com/files/4cdfea8e-d001-460f-8e98-d3da1ebeebbb/pogabekamokisejakef.pdf
    • https://uploads.strikinglycdn.com/files/2b6ec768-9589-421b-9b95-9995929b290b/18857105479.pdf
    • https://uploads.strikinglycdn.com/files/da2a07ee-0d3c-4df3-8202-eecaffaba932/zimam.pdf
    • https://uploads.strikinglycdn.com/files/856b467d-3104-4960-b6e6-4d141f7b3911/what_is_chi_healing.pdf
    • https://uploads.strikinglycdn.com/files/8aba16f7-d8d7-4ce9-9e30-f17f2d7848b2/how_to_answer_flip_phone_when_open.pdf
    • https://uploads.strikinglycdn.com/files/035bf5fb-7095-4cfa-a20c-3762776e6b60/parigunarivamur.pdf
    • https://uploads.strikinglycdn.com/files/0dead80e-3b2a-42bc-9340-68ab9333f4d6/1998_polaris_xplorer_400_owners_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102eb.bin
b9a84e2d70e3a6fc3341b456bb287f05562182bbf42b14aced235ce783419c1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102EB 4796 bytes
font_01_sfnt_off0001136f.bin
70b8a719f3ca21209ca9dcd726be36724a28ef334fafa09bf37bf266e5c9870c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1136F 12052 bytes
font_02_sfnt_off00013b8b.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B8B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.