Malicious PDF — malware analysis report

Static analysis result for SHA-256 e410285f124e7641…

MALICIOUS

PDF

83.9 KB Created: 2021-05-31 17:11:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a60ea621d403e6aff24bf7eb74052564 SHA-1: 78a325987f0bc9a1922089d1e7e2bd8174aa13db SHA-256: e410285f124e76413fa400138f4ce563123f04c91cd3238ff7d29a7085990914
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. The document body contains a seemingly innocuous search query about calorie information, which is likely a lure. An embedded URI points to 'botokaw.ru', a domain associated with phishing or malicious redirects, suggesting the document's purpose is to trick users into visiting a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wb?keyword=how%20many%20calories%20in%20a%20jersey%20mike
    • https://cdn-cms.f-static.net/uploads/4468274/normal_602baa15e5e0a.pdf
    • https://cdn-cms.f-static.net/uploads/4403684/normal_6056bbec36d2c.pdf
    • https://static.s123-cdn-static.com/uploads/4380088/normal_5ffc30691c332.pdf
    • https://static.s123-cdn-static.com/uploads/4370746/normal_5fddb18c4d01b.pdf
    • https://cdn-cms.f-static.net/uploads/4366620/normal_60303325cde3a.pdf
    • https://cdn-cms.f-static.net/uploads/4426819/normal_60623203f0b80.pdf
    • https://cdn-cms.f-static.net/uploads/4369656/normal_60183053ed4ae.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kipizasuzeda.pbworks.com/f/download_harvest_moon_fomt_gba_bahasa_indonesia.pdf
    • http://kolasotosexu.pbworks.com/w/file/fetch/144414129/itouch_air_se_smartwatch_manual.pdf
    • https://uploads.strikinglycdn.com/files/a9363578-aba9-451d-b9fb-4061199af12d/towamesimuwunodago.pdf
    • http://funinupun.pbworks.com/f/online_live_tv_software_free_download_for_pc.pdf
    • http://kufujibumufa.pbworks.com/w/file/fetch/144412485/how_to_do_a_paracord_handle_wrap.pdf
    • https://uploads.strikinglycdn.com/files/bee9da0f-4bf2-426b-962e-014acd969e70/handwriting_practice_sheet.pdf
    • http://xojifot.pbworks.com/f/sony_cyber_shot_hx400v_instruction_manual.pdf
    • http://funinupun.pbworks.com/f/mavufemomupuron.pdf
    • https://uploads.strikinglycdn.com/files/611ca9bf-525c-415e-9073-60c6666334d5/races_in_warhammer_total_war_3.pdf
    • http://kufujibumufa.pbworks.com/w/file/fetch/144411645/how_to_connect_vizio_wireless_sound_bar.pdf
    • https://uploads.strikinglycdn.com/files/4bbfa8b1-aef5-408c-a0d9-3c5568085e01/how_many_oz_in_a_rt_44_sonic_drink.pdf
    • http://zezimin.pbworks.com/f/42016832839.pdf
    • http://nilanom.pbworks.com/f/zisoxubujezi.pdf
    • http://wuxikadafi.pbworks.com/w/file/fetch/144413442/riruroxopowerubokeburapuz.pdf
    • http://kekirow.pbworks.com/w/file/fetch/144412113/hp_compaq_8200_elite_sff_pc_drivers_windows_10.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b3e.bin
3b798859848ab16c213ebf77cd2c9c5608c4277062ca23ac184617915c42bbe4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B3E 5416 bytes
font_01_sfnt_off00011daf.bin
9e3784e63478772196bbc3a531df8a192ebeb9da3871ef9a904bae265125148e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DAF 10872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.