Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c71bd7f7d184bd7…

MALICIOUS

PDF

71.9 KB Created: 2021-03-20 23:44:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a8f31a522c768c796dae2ac824266eea SHA-1: ddd8d800654ca1c6d5ca97a3c6e53f9d838d9605 SHA-256: 9c71bd7f7d184bd705877b6498d3b0c93649e0950b6872a3e618a690893c2bf2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URI pointing to 'https://botokaw.ru/wix?keyword=soehnle+baby+scale+manual', suggesting a phishing or malware distribution attempt. The presence of a visual download button heuristic further supports a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=soehnle+baby+scale+manual
    • https://cdn-cms.f-static.net/uploads/4496816/normal_60248c92e2057.pdf
    • https://cdn-cms.f-static.net/uploads/4454808/normal_602b01b3c8d9c.pdf
    • https://static.s123-cdn-static.com/uploads/4478670/normal_600420fecccd2.pdf
    • http://accface.in/39114351435b5tqv.pdf
    • https://static.s123-cdn-static.com/uploads/4452845/normal_5ff18400d57d2.pdf
    • https://suwesinorilofev.weebly.com/uploads/1/3/4/0/134096988/1578375.pdf
    • http://hihikane.space/akll_ay_barda_lipton_oyna0uaro.pdf
    • http://collegegraduatecentraldating.com/hamachi_password_rejectedl8zu5.pdf
    • https://nisudine.weebly.com/uploads/1/3/1/4/131454656/0a68b3.pdf
    • http://mon-compte-cmb.best/square_root_worksheetsha7al.pdf
    • https://jojiwunu.weebly.com/uploads/1/3/5/3/135387754/tikikisuxe.pdf
    • https://static.s123-cdn-static.com/uploads/4379719/normal_5fe34b2c80381.pdf
    • https://cdn-cms.f-static.net/uploads/4369908/normal_6044984255f19.pdf
    • https://pazuvokase.weebly.com/uploads/1/3/4/6/134615635/fetipu.pdf
    • https://static.s123-cdn-static.com/uploads/4389582/normal_5fcc6647e5d51.pdf
    • https://cdn-cms.f-static.net/uploads/4369309/normal_602d65c3640d5.pdf
    • http://reduslimitalia-oficial.site/what_is_the_gift_of_word_of_knowledge_in_the_biblerlkp5.pdf
    • https://juzoliposiwe.weebly.com/uploads/1/3/4/3/134322138/jiruwepoj-kupix-jevibez-zelotutix.pdf
    • https://cdn-cms.f-static.net/uploads/4446773/normal_605076e27be98.pdf
    • https://tunimesepet.weebly.com/uploads/1/3/1/4/131455680/sisexudugo_tugane_pironoso.pdf
    • https://mojapilujo.weebly.com/uploads/1/3/0/9/130969316/jeziwezar.pdf
    • http://fitit.space/94974646103kux3i.pdf
    • http://randname.ru/how_install_vinyl_decalsdrddl.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7c4.bin
e33928ccc1a1272f40995deed832cdd84496b177ba6b0b475155f2a02f39d778		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7C4 5288 bytes
font_01_sfnt_off0000e9a6.bin
397f3ef682fe08b68d4d8162c1665f566c8b69dd98e9faac978c73b63a624824		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9A6 11812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.