Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9fffc23e8b4348b…

MALICIOUS

PDF

91.9 KB Created: 2021-03-24 15:54:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 893f3dbccb92e89a7d223bb446b7d868 SHA-1: bdfd3dff9548387b5c60cde71b2833a885a86ded SHA-256: a9fffc23e8b4348bc6b1bdff37196ad75572fe5a8ae9b340acbecf3397b51535
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains an embedded URI pointing to 'https://botokaw.ru/wix?keyword=weak+acids+and+bases+worksheet', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'Weak acids and bases worksheet'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=weak+acids+and+bases+worksheet
    • https://pukogapuwobar.weebly.com/uploads/1/3/4/3/134307851/romemadexevad.pdf
    • http://mebets.xyz/bombas_socks_couponx1ym4.pdf
    • https://cdn.sqhk.co/nixafusoda/Viigjcf/vr_ping_pong_free_download.pdf
    • https://sokuvefababadax.weebly.com/uploads/1/3/1/8/131856373/7696488.pdf
    • https://cdn.sqhk.co/zanivuwiduvo/gjj8sja/classic_gumball_machine_with_stand.pdf
    • https://cdn-cms.f-static.net/uploads/4457868/normal_601ee268b5591.pdf
    • https://static.s123-cdn-static.com/uploads/4471988/normal_5fc70d27c2b6a.pdf
    • http://smeshnoykir.space/58239185558zf241.pdf
    • https://cdn-cms.f-static.net/uploads/4427077/normal_5fdc526aee9d8.pdf
    • https://cdn.sqhk.co/velizovatim/jgrc3gd/download_smash_bandits_racing_mod_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4444623/normal_60247cbf0fc70.pdf
    • https://cdn-cms.f-static.net/uploads/4477139/normal_6013ed824b7c8.pdf
    • https://mufuwavujove.weebly.com/uploads/1/3/4/0/134042856/nurifopomafogidoxefu.pdf
    • https://cdn.sqhk.co/zolewiko/hjggZl1/10410858886.pdf
    • http://vkysnaya-eda.site/hi_point_carbine_disassembly_instructionsli6fc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vokeri/how_to_explain_love_in_one_word.pdf
    • https://s3.amazonaws.com/fusopoxipo/48856929003.pdf
    • https://uploads.strikinglycdn.com/files/c04ef251-c647-427e-ae87-7bc91008a357/company_of_heroes_legacy_edition_trainer.pdf
    • https://uploads.strikinglycdn.com/files/8e4c0c7c-8de2-448e-8503-e56fe720e831/82171539221.pdf
    • https://s3.amazonaws.com/minaxigevani/apple_iphone_logo_hd_image.pdf
    • https://s3.amazonaws.com/bezutu/89910247469.pdf
    • https://s3.amazonaws.com/pibabopuduj/82389427067.pdf
    • https://uploads.strikinglycdn.com/files/03e8004c-7530-4963-b879-6769f0ee3706/how_to_increase_stamina_for_playing_football.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000126e2.bin
dfbc43b2a068b00e64b8249de67d1455a7fdc16231d6ac842c0312e3075a6844		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126E2 5304 bytes
font_01_sfnt_off000138fc.bin
1aba9d97f862f2b89c7bf7a23204de666f337f26e732be6cfee11ecf1d73d191		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138FC 11908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.