Malicious PDF — malware analysis report

Static analysis result for SHA-256 e84cf46ea0393082…

MALICIOUS

PDF

382.6 KB Created: 2021-04-02 13:16:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b08aa9c0c4b2da63c6849d39288a0be3 SHA-1: 1ed2fd91fe23daacef92fdd8f3c357f0b03a6e38 SHA-256: e84cf46ea0393082aca52e9e30cd3c2b096db06f81845d7d2232ac741f6336ce
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The sample was detected as malicious by ClamAV and an ML classifier, and exhibits characteristics of an advance-fee scam. The embedded URL `https://botokaw.ru/wix?keyword=call+of+cthulhu+investigator+handbook+pdf` suggests a lure to download a PDF, likely containing further malicious content or phishing attempts. No scripts were extracted, but the PDF structure and external URI heuristic indicate a potential for exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9815

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=call+of+cthulhu+investigator+handbook+pdf
    • https://static.s123-cdn-static.com/uploads/4501965/normal_5ff249d716825.pdf
    • http://damvglaz0.xyz/1989_mazda_b2200_workshop_manualhani4.pdf
    • http://kofoxulemaxabur.22web.org/usps_return_to_sender_unopened_package.pdf
    • http://gasolotiravizid.sportsontheweb.net/77678916449.pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • https://cdn-cms.f-static.net/uploads/4368467/normal_603c2a585309e.pdf
    • http://prodson.space/what_is_a_calorie_deficit_and_how_does_it_workvfp1p.pdf
    • http://sabumow.mygamesonline.org/stay_with_me_sam_smith_sheet_music.pdf
    • http://martakkord.ru/honeywell_hcm_350_humidifier_near_mevmw9p.pdf
    • http://mnclassis.org/arseny_tarkovskyybc3r.pdf
    • http://digtalcaliper09.xyz/great_lakes_sunlighter_spa_manual4p69r.pdf
    • http://remontnatali.ru/humminbird_fish_finder_transducer_mounte2nmw.pdf
    • https://static.s123-cdn-static.com/uploads/4487618/normal_5fcd1a1303c62.pdf
    • http://opssmall.space/40399966543dwzw6.pdf
    • http://xitabijasava.getenjoyment.net/tagivo.pdf
    • https://cdn-cms.f-static.net/uploads/4402261/normal_60413cebbb144.pdf
    • http://goodxday.xyz/bookmark_manager_app_for_androidhi39l.pdf
    • https://cdn-cms.f-static.net/uploads/4467975/normal_6028879a6e68c.pdf
    • http://wegoradubi.sportsontheweb.net/17109310714.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://buwomonemagup.epizy.com/piwalavodelinilopude.pdf
    • http://tikimolanevi.rf.gd/how_to_fix_flashing_red_light_on_samsung_tv.pdf
    • http://solivafimir.epizy.com/70799564076.pdf
    • http://nukilaba.myartsonline.com/simple_admin_panel_html_css_template_free_download.pdf
    • http://fekajot.rf.gd/body_systems_webquest_answer_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000592da.bin
9e068effdc240e51cfe9cb8dcd913c81cbd717fbaa68770ae070ff477c6e1887		 pdf-font-stream PDF embedded font (sfnt) at offset 0x592DA 5588 bytes
font_01_sfnt_off0005a5d1.bin
d5f004ae782009bfc50ab4933d1bef2be9bf63bfb4ba0d895ad69d4d01e2590c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A5D1 14112 bytes
font_02_sfnt_off0005d379.bin
541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D379 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.