Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5a751f6e20a68f2…

MALICIOUS

PDF

79.8 KB Created: 2021-03-31 05:26:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9928884fcf71b9dab43045e9ab47fd79 SHA-1: 4acd9832408f1d33c19c0cba6e04f018023e37ba SHA-256: f5a751f6e20a68f2753c7ed2ea0a7974023591fe49e9fe2862cbd166f4f694c5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'botokaw.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'Marques de Sade biografia', which is used to disguise the malicious nature of the link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=marques+de+sade+biografia
    • https://cdn.sqhk.co/vawapisoxe/jiicG7H/ziripizobuzug.pdf
    • https://cdn.sqhk.co/businaxidare/ijji2LE/falls_road_animal_hospital_boarding.pdf
    • http://gayerkan.com/326858216512wid.pdf
    • http://gufutaca3.xyz/duties_and_rights_of_an_auditorsmcqa.pdf
    • https://cdn-cms.f-static.net/uploads/4423453/normal_605d894b6218c.pdf
    • http://cparta.moscow/the_one_thing_book_club_questions7txsh.pdf
    • http://degitowexara.iblogger.org/rabinefimafepaxofisug.pdf
    • https://cdn-cms.f-static.net/uploads/4407789/normal_5fe9d2dbce160.pdf
    • http://ratebekanolaja.22web.org/muxofofok.pdf
    • http://xtreme-sport.ru/disney_plus_login_issuesjkogh.pdf
    • https://cdn-cms.f-static.net/uploads/4412606/normal_6013a5c7aab5d.pdf
    • https://cdn-cms.f-static.net/uploads/4425483/normal_602d0c7b1c98d.pdf
    • https://cdn.sqhk.co/lilodipu/bijeGge/x-_plore_file_manager_mod_apk.pdf
    • http://sojuvofud.22web.org/70254041305.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f039f7e9-c7fa-441d-bf3d-2f0e35d6be10.filesusr.com/ugd/80685d_59edf5744e774f76b3d0f91f3b99b593.pdf?index=true
    • https://80b1f93a-fe74-4439-a81d-34814fa7a505.filesusr.com/ugd/e56fe2_d22040cc33ff4f778d638cecd1fe4bee.pdf?index=true
    • http://lugorigarotari.epizy.com/53033448566.pdf
    • https://uploads.strikinglycdn.com/files/1e5eaf11-c6b5-4fc8-a4b5-a682f158bc41/jogusibom.pdf
    • https://d397443b-80d0-4e74-967c-4ce830ee3754.filesusr.com/ugd/0a76f0_c0583586e2484c7ba4424f28dce7576d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4d9219f8-c0e6-4a58-b68c-a49f424f43f0/iphone_6s_plus_schematic_boardview.pdf
    • http://xudurimujekib.rf.gd/joe_turners_come_and_gone_summary_act_1.pdf
    • https://e0529b0e-ffd4-46ae-8a9e-348c3aa8e3ae.filesusr.com/ugd/27320f_c5efe2aaeaf74017a4a74213bad6dcbd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3fd38ca1-13ad-408b-84e6-e62826af032e/which_colour_is_best_for_day_function.pdf
    • https://uploads.strikinglycdn.com/files/72a3863b-a2e0-4a51-8b3b-60f28501276d/96575452148.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f807.bin
01d738d0ba8b970791709e3daf65f933c0dc70fa714920b8e0f07cfce5335446		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF807 5316 bytes
font_01_sfnt_off00010a2d.bin
c722f1d1ae48b711ea6a7716448503ae77fb57e8f33291bc0054a31a7c2c1e9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A2D 11872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.