Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8e19152476f1414…

MALICIOUS

PDF

71.6 KB Created: 2021-04-01 06:05:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 084dc05dea1113eae6e0b6afafbb5464 SHA-1: dd7fe8c34eb2b8b2a55095a59da8bd78c7691215 SHA-256: b8e19152476f141464c1a045e372105bb3e04a02d0a2bc758cbf96a2ddfd8e99
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'botokaw.ru', which is likely a malicious domain used to host or redirect to a second-stage payload. The document body, though heavily obfuscated, suggests a lure related to a 'separation of powers worksheet'. No scripts were extracted, but the presence of external URIs and the malware detection strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=separation+of+powers+worksheet
    • http://farvestnn.ru/fotesasorojurbcoc8.pdf
    • https://cdn.sqhk.co/litopozuf/ghfjhib/voice_training_wikihow.pdf
    • https://cdn.sqhk.co/rudolikube/egiNmOX/5507611619.pdf
    • http://souve.me/spice_and_wolf_light_novel_englishj0tmb.pdf
    • https://static.s123-cdn-static.com/uploads/4366041/normal_5fe33d390f728.pdf
    • http://iclod.tech/fovaledijaboxpl7i.pdf
    • http://gk-kuban.ru/turbochef_tornado_oven_manualzd11j.pdf
    • http://simkosa.website/screwtape_letters_summary_of_each_letterd3vip.pdf
    • https://cdn-cms.f-static.net/uploads/4407552/normal_602cea37cf033.pdf
    • https://cdn-cms.f-static.net/uploads/4366377/normal_601471363cbcf.pdf
    • http://whitetwo.space/killing_floor_2_xbox_one_updateiu1km.pdf
    • https://cdn-cms.f-static.net/uploads/4374848/normal_6017033b50164.pdf
    • https://cdn-cms.f-static.net/uploads/4366045/normal_604a405a9a55d.pdf
    • http://sexesex.site/87995086298m7qjt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/eb2b3b46-7d07-4a5c-a352-087da364cc9c/the_cider_house_rules_book_summary.pdf
    • https://uploads.strikinglycdn.com/files/9565f558-0172-4313-9f4a-f5946b5e3e07/cuntos_habitantes_tiene_la_ciudad_de_mxico_en_el_2019.pdf
    • https://uploads.strikinglycdn.com/files/25224bc7-e78e-4524-8c8c-59a45c1c8cc6/dewef.pdf
    • https://uploads.strikinglycdn.com/files/e342881b-1453-415e-8368-8c7f006c215d/is_there_a_season_4_of_happy_endings.pdf
    • https://uploads.strikinglycdn.com/files/01821ce2-5860-463d-b52d-be4b231131e5/modo_de_produccion_economia_primitiva.pdf
    • https://uploads.strikinglycdn.com/files/db1d26c9-4a28-48d5-b32d-57407ced7aaa/correcting_run_on_sentences_worksheets_with_answers.pdf
    • https://uploads.strikinglycdn.com/files/47eb4c7f-d70b-480d-978e-17942f522621/jetujiterabu.pdf
    • https://uploads.strikinglycdn.com/files/c2c7427e-4c3a-4f5e-bd53-a50fd0d770a3/guxofaramewenilajoxe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9da.bin
9cdaa7072154b44539e5370e93943cda655be3211f5e755add3fd9bf8ed7c5d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD9DA 5216 bytes
font_01_sfnt_off0000ebab.bin
b770c7cc097b7ef2cd796d5a7c0f795dd6842b988eac6f4e1ba2b9f22fa0f458		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBAB 11044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.