Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec7a066d0ab333b2…

MALICIOUS

PDF

88.4 KB Created: 2021-05-22 08:53:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: cfc53fe8709737bbea17a21275b955be SHA-1: 412949f34d792fb65ccf0aabc771fc4e7cc5c30c SHA-256: ec7a066d0ab333b280639e636efa88f030f9dacb6b1264fe67e783d8e8ac12a3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'botokaw.ru', which is likely used to host a phishing page or download a secondary payload. The document body, though heavily obfuscated, contains text related to 'mala prayer beads' and the authoring application 'wkhtmltopdf', suggesting a lure to a malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9919

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+use+mala+prayer+beads PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4409394/normal_603ea78bd03a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421613/normal_6017478158a72.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4505699/normal_6052ad1252df6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420029/normal_5fe41cc6ad96a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375696/normal_60434f05bf6ec.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.thdl.org/http://www.thdl.org/TibetanIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/nevovumowa/folux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc1d382a-157a-4eb4-8f33-8be9805771d9/lasenizifebagesirudema.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5736c7c2-c190-4e55-9823-62e0270aa3cd/grounded_theory_approach.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed514db4-1892-41c1-8613-2b2e5438c943/eiu_worldwide_cost_of_living_2019_full_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64476e87-873a-44b8-8df1-f4ace50926ba/roxekuforovazesozokexatum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a24b232-b677-4f0c-a0df-3d1cd5896e87/john_the_ripper_output_password.pdfIn PDF document text
    • https://s3.amazonaws.com/boxujetanonikuv/how_to_calculate_vehicle_efficiency.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3259bb7e-feb3-482d-acae-7faf3b832c70/words_their_way_scoring_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/058b2b8e-b4bd-436f-a02d-2e8e9faf838f/vikikuju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38212860-b7ca-43ac-9ea6-559161d66433/the_culture_code_book_club_questions.pdfIn PDF document text
    • https://s3.amazonaws.com/suximawo/bios_lenovo_g50.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/249bc6b4-2858-45f4-adeb-fa8b915ae6b2/1907552834.pdfIn PDF document text
    • https://s3.amazonaws.com/tadevewuju/real_estate_appraisal_exam_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2838b40-5007-4735-97e3-7f6beedef188/garmin_gpsmap_64s_vs_64sc.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/ladozolif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5eb1f58-1fac-4b40-9633-6ff50dee37fe/how_much_does_an_aws_certification_cost.pdfIn PDF document text
    • https://s3.amazonaws.com/tetenifeme/ligagojuvab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/450d5615-afce-408e-bc98-334efc87512d/gazozoxiradona.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d621a4d5-b157-45eb-a83b-7b1323d76645/pudimasoxinisolibabuje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb4fbd05-3db8-44fa-998f-3e1d82cf23e7/harga_cartridge_printer_hp_laserjet_p1006.pdfIn PDF document text
    • https://s3.amazonaws.com/meludav/zugamosirubuterem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f54489e-fabb-4f60-8389-09d02b69b6c7/hajj_guide_malayalam.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlTibetanIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB9F 5128 bytes
SHA-256: 6c115a45b8224bb71eefa3d4170c7c86f8269e7e9857cd68d32e58f705fa2b64
font_01_sfnt_off00010d1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D1F 9532 bytes
SHA-256: 1e852db99fd6daa80e21e587877ddffaa19386bd1f986b898c72af8e44008dd5
font_02_sfnt_off00012083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12083 10792 bytes
SHA-256: 810981a61fb99927d2d8c55bd36471b4d26fce7da65f97c2f252f2666ef1f99b
font_03_sfnt_off0001452a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1452A 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.