Malicious PDF — malware analysis report

Static analysis result for SHA-256 f54d2011482654a4…

MALICIOUS

PDF

155.2 KB Created: 2021-03-21 23:13:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 08b5e6bc96d3be425673f43eef821c48 SHA-1: 42c1f41dd62c1c7d9d56c71238665a51397c07af SHA-256: f54d2011482654a4a04475db3408de6ed39d325ce44a25e1da60b9d9176a8989
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, and ClamAV detection confirms it is a phishing trojan. The document body, though heavily obfuscated, appears to reference a 'Russia football world cup schedule pdf', suggesting a lure to entice users to click the malicious link. No scripts were extracted, but the presence of an external URI and the phishing detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9748

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=russia+football+world+cup+schedule+pdf PDF link annotation
    • http://fituxem.sportsontheweb.net/gemupozivukuxo.pdfIn PDF document text
    • http://gosoxegekiri.mywebcommunity.org/61495550129.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/wutelegiwuda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/715ab229-1219-40f4-9a7f-a5c997f80b88/difasar.pdfIn PDF document text
    • https://s3.amazonaws.com/fadedosi/arctic_animals_printable_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d971a300-ac9d-4b47-80dd-87ce095cb236/harry_potter_wand_quiz_pottermore_questions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f4f4cfc-8e34-4b60-aacd-f8bde30934ff/56136305343.pdfIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/how_to_use_canon_ij_scan_utility_mac.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96a2699f-e6b2-4cd7-9101-8b3da43aa299/how_to_make_origami_crane_steps.pdfIn PDF document text
    • https://s3.amazonaws.com/wamatasamegu/cursive_letter_e_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/navoburarovada/70550134297.pdfIn PDF document text
    • https://s3.amazonaws.com/pisik/apec_2018_png.pdfIn PDF document text
    • http://nejesezape.myartsonline.com/35824337505.pdfIn PDF document text
    • https://s3.amazonaws.com/sagotomagin/xukulexi.pdfIn PDF document text
    • https://s3.amazonaws.com/midizaxopazeji/23684946208.pdfIn PDF document text
    • https://s3.amazonaws.com/patilawasu/dd_3.5_complete_warrior_feats.pdfIn PDF document text
    • https://s3.amazonaws.com/retisovojor/spotify_pro_apkpure.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff2d5fa9-8cf1-4b55-87ef-d43b33f42be5/3406770472.pdfIn PDF document text
    • https://s3.amazonaws.com/pafiganovavi/kajikexukeratet.pdfIn PDF document text
    • https://s3.amazonaws.com/dalava/50063773989.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0de6ed7d-4149-4be8-a10c-8fc4f4df88b7/jivupati.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29fc793a-85a9-4301-881d-3ac70256791e/dinunozowel.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000243f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x243F6 5480 bytes
SHA-256: f0f874534732ef0b5300f9a561094672cf07efc234723f776fe14833e9f2c2f8