Malicious PDF — malware analysis report

Static analysis result for SHA-256 e905da7a56e46087…

MALICIOUS

PDF

86.2 KB Created: 2021-02-28 14:52:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c190d33168e01c8263a2be2acbce286b SHA-1: 028a07710fac1f9b862eb350818d684e12d89cfd SHA-256: e905da7a56e46087df70586aa7d7936a7d49ce65d524b69d53a91a16cbafb37a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ML classifiers and ClamAV as malicious. It contains an embedded URI pointing to 'https://botokaw.ru/123?utm_term=entwined+in+you+ashlee+rose', which is likely used to deliver a secondary payload or conduct phishing. The PDF structure and embedded content suggest an attempt to disguise malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=entwined+in+you+ashlee+rose
    • https://cdn.sqhk.co/nemazuwigumo/hieRieM/big_win_racing_mod_apk_4._1._2.pdf
    • https://cdn.sqhk.co/zifeduwa/biaibgh/67814921174.pdf
    • http://salufogi.iblogger.org/bold_9900_software.pdf
    • https://cdn-cms.f-static.net/uploads/4388432/normal_6038cdff79f84.pdf
    • http://vipadobotisituz.mygamesonline.org/how_does_wic_calculate_income_for_military.pdf
    • https://cdn.sqhk.co/posojuvapono/fP8JPic/xejamega.pdf
    • http://dasiwujupuna.sportsontheweb.net/14283893411.pdf
    • https://cdn.sqhk.co/tivanosox/flgejia/fruits_mania_fairy_rescue_apk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/papuja/ibps_clerk_2018_books_free.pdf
    • https://s3.amazonaws.com/wazorixekunafob/sacred_vs_profane_sociology.pdf
    • https://s3.amazonaws.com/zomuzigo/6102270240.pdf
    • http://pigutun.myartsonline.com/properties_of_matter_crossword_worksheet_answers.pdf
    • https://s3.amazonaws.com/lovomijelun/reporting_of_maltreatment_of_minors_act.pdf
    • https://s3.amazonaws.com/benuka/mabeku.pdf
    • https://s3.amazonaws.com/zemunomipazikez/sewavemadogo.pdf
    • http://wejajesenopezoj.onlinewebshop.net/55914339726.pdf
    • https://s3.amazonaws.com/nupotukig/lifemunofukilipaj.pdf
    • http://penenidapuveg.epizy.com/30717454484.pdf
    • http://gesuposobevexo.rf.gd/43874551635.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e69a.bin
3d4760ca295192c89086870ebbac49c5a5945404ea6ab57fca452cf2db5f569a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE69A 6440 bytes
font_01_sfnt_off0000f68e.bin
1e4bc8878f64c988387fd77425d6b9b5f48b736f987047a28073c3f398f90244		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF68E 5064 bytes
font_02_sfnt_off000107ce.bin
af02b1c5d2ca8361f210a5feddcc93f12056d8ff53c851846c9e3c1e97872f67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107CE 1956 bytes
font_03_sfnt_off00011136.bin
4325a50ab2846304955277411f8a34eb9e0907e1b32885aae2f60180e1d2e25b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11136 10896 bytes
font_04_sfnt_off000135cc.bin
52db30b66cfb76898988bc7c6ed152514c301740808ab95bec9c68e49df23550		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135CC 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.