Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee65b73fb435fdd7…

MALICIOUS

PDF

90.5 KB Created: 2021-04-02 08:10:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1effdc6a28352df53ce66d0b252bdb23 SHA-1: 879ceacb4f4ccba76b027d27d3cf704aae21a0a7 SHA-256: ee65b73fb435fdd77feb54b5bf3f3c52e6f239378c1f8efe73d994dbaca80789
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of numerous embedded URLs, including one pointing to 'botokaw.ru', suggests the document is designed to redirect users to potentially harmful websites. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are consistent with phishing or malware delivery tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=xanthoma+adalah+pdf
    • http://gerda-msk.ru/brother_hl_2240_laser_printer_driver_download1uc7e.pdf
    • http://disozire.mygamesonline.org/tesunika.pdf
    • http://card2card-perevod24.site/new_vermeer_bc1000xl_for_saledrug5.pdf
    • https://cdn.sqhk.co/vexavudakepa/3iixIgd/zugikakoj.pdf
    • https://cdn.sqhk.co/pesegozod/hcgcbwO/17230578362.pdf
    • https://cdn.sqhk.co/xedopuwuzosa/0ULOIif/nenivubu.pdf
    • http://wijetaz.mypressonline.com/jibewi.pdf
    • https://cdn.sqhk.co/semobisugigi/rjcwygj/mental_illness_symptoms_checklist.pdf
    • https://cdn.sqhk.co/reriwoduriju/d82R3he/my_talking_tom_friends_download_app.pdf
    • http://xomaraj.iblogger.org/star_trek_discovery_season_1_episode_12.pdf
    • http://geesecam.com/97035053346e4uc.pdf
    • http://mastericy-chistoty.ru/sportspower_mill_creek_canyon_wooden_swing_set_assembly_instructionsv3vnb.pdf
    • http://xepidenad.scienceontheweb.net/96752813433.pdf
    • https://cdn.sqhk.co/dutebevon/gjiihjg/zowunefavizel.pdf
    • https://cdn.sqhk.co/xelajura/jancSKI/photo_collage_ideas_for_birthday_party.pdf
    • http://punejew.mygamesonline.org/how_to_pronounce_english_words_correctly.pdf
    • http://xawamiwupajev.mygamesonline.org/41606265216.pdf
    • https://cdn.sqhk.co/zolulesar/rocgcij/traffic_racer_mod_apk_rexdl.pdf
    • http://igclienteam.com/present_and_past_verb_tenses_exercises3vpjx.pdf
    • http://www.opentle.org
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fazaburifug.myartsonline.com/tinituwejetovexovoj.pdf
    • http://pebenuxotuk.epizy.com/lt_meaning_g_shock.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://www.gnu.org/licenses/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000f751.bin
cd51999a47034b6806fc251afe684a646daa0e9e3a8b5eda9f394aae19ad43ca		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF751 17288 bytes
font_00_sfnt_off0000e7f3.bin
36db50ab12c67d3641f47cd27b752cd5d25f9af6e5a920823cab2d64c7f5fa2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7F3 4604 bytes
font_02_sfnt_off000126a6.bin
b81710dc22061d71c9dc51ead8cad70863f11a9647d76772888dfea7b84d6f3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126A6 10596 bytes
font_03_sfnt_off00014b08.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B08 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.