Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2a0ae58ca5157b5…

MALICIOUS

PDF

97.5 KB Created: 2021-03-23 23:50:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: ab4c82f58584130a2faa8293452e6007 SHA-1: 028536b2667f531a85046f87877e70e20599e16e SHA-256: d2a0ae58ca5157b56c0627d002a9329cf8aae307ce0f1eda71c334d0d8fc5546
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, 'botokaw.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to an educational worksheet, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=worksheet+on+adaptation+of+plants+class+4 PDF link annotation
    • http://trafikcezaodebayisi.com/19632110527a0cvt.pdfIn PDF document text
    • http://hotita.space/12422351252iwghr.pdfIn PDF document text
    • http://toxaxugepevu.iblogger.org/muzat.pdfIn PDF document text
    • http://getveran.site/possessive_noun_worksheet_for_grade_2fq96r.pdfIn PDF document text
    • http://useporte.xyz/alexandria_va_file_police_reportc6dd8.pdfIn PDF document text
    • http://gebuhrenfrei-mein.com/best_books_for_gmat_verbal_preparationqy33n.pdfIn PDF document text
    • http://usesalle.xyz/asiga_pico_2_manualq3qbz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://logururud.epizy.com/deguponujajazifiw.pdfIn PDF document text
    • https://s3.amazonaws.com/kubafezin/takovubonavosuvolotaxeso.pdfIn PDF document text
    • http://wigunegulawiko.rf.gd/30565928370.pdfIn PDF document text
    • http://mulusatore.rf.gd/76007064524.pdfIn PDF document text
    • https://s3.amazonaws.com/bupaxomu/20931856374.pdfIn PDF document text
    • https://s3.amazonaws.com/tosevud/bcaa_polyp_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/davubewu/32187220035.pdfIn PDF document text
    • https://s3.amazonaws.com/posufij/35116062562.pdfIn PDF document text
    • http://sivinufedumoja.rf.gd/relacion_antigeno_prostatico_libre_y_total.pdfIn PDF document text
    • http://nesowoxaxisaxa.rf.gd/wivapuzogedotoje.pdfIn PDF document text
    • https://s3.amazonaws.com/vibasujefir/99452072761.pdfIn PDF document text
    • http://zigimavabixexib.epizy.com/search_engine_free.pdfIn PDF document text
    • https://s3.amazonaws.com/petubapizo/52850261016.pdfIn PDF document text
    • http://zezatavaveb.epizy.com/araba_oyunu_apk_indir_gezginler.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105E9 5408 bytes
SHA-256: 8d4660071d12ba879dc448820542785da45c352ed975ad47b862351eb52c7cc7
font_01_sfnt_off0001185f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1185F 20244 bytes
SHA-256: 5b1f78dec72dd807cbacc3b04106537389bf005e9e85491197f9eb5a9ed6fc6e
font_02_sfnt_off0001528d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1528D 16352 bytes
SHA-256: f86a52f8c75f269efc4c46c12062500379d8d321d35157498df53c6f6c16d8d0
font_03_sfnt_off000168ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x168AE 3980 bytes
SHA-256: 80470c909512593783c6d634881b356048a0e1118696e630e5f1f3119d46ada7

Open this report in the interactive analyzer, or submit your own file for analysis.