Malicious PDF — malware analysis report

Static analysis result for SHA-256 018a92fa10d6a50f…

MALICIOUS

PDF

85.7 KB Created: 2021-03-30 18:03:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 913f85dd23fe89920f93a72a3682382d SHA-1: e7feb1b343315134c9fed39c7337b3a63b02054e SHA-256: 018a92fa10d6a50fb5fed377410402762aeaba3c7a56648c6d1c0c110b240fd3
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document exhibits characteristics of an advance-fee scam, presenting a lure related to a lottery or prize requiring further action. It contains numerous external links, many of which are part of a link farm, suggesting an attempt to distribute malicious content or redirect users to phishing sites. The ML classifier and ClamAV detection strongly indicate malicious intent, likely involving the distribution of a trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=java+basics+for+interview+pdf
    • https://cdn.sqhk.co/ganuniwiku/8ieFxgg/fovejurigud.pdf
    • https://cdn.sqhk.co/zifibikom/jzVhfjc/bidetedawubi.pdf
    • http://meetchat.space/icivics_anatomy_of_the_constitution_worksheetihyjj.pdf
    • http://renakuw.iblogger.org/pijabixo.pdf
    • https://cdn.sqhk.co/monasomeb/UTLjage/wesusinosinepok.pdf
    • http://dusikazo.mypressonline.com/merikugupeniro.pdf
    • https://cdn.sqhk.co/zarejesorufo/djcizjg/97543647735.pdf
    • https://wulapoledonuker.weebly.com/uploads/1/3/2/6/132695240/7602066.pdf
    • https://cdn.sqhk.co/govonesed/cighgif/10_drop_hitch_ball_mount.pdf
    • http://zinefikitozozeg.sportsontheweb.net/biotechnology_class_12_notes.pdf
    • http://raisinsapp.pro/59812958476kjz2w.pdf
    • https://bixowupe.weebly.com/uploads/1/3/1/4/131409305/gorobafa.pdf
    • http://tiwujatujoput.mygamesonline.org/how_to_calibrate_oven_thermostat.pdf
    • http://lalevuw.mypressonline.com/navufesola.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gugefojekasarul.epizy.com/action_photoshop_cs6_free.pdf
    • https://uploads.strikinglycdn.com/files/954e2ad6-e10a-461e-80b2-c47207506653/refazenikonili.pdf
    • http://laboluvimaniraf.epizy.com/vomarikab.pdf
    • https://uploads.strikinglycdn.com/files/357bd064-3149-48c1-a6fe-339902e0d6ed/how_big_should_a_sample_size_be_in_quantitative_research.pdf
    • http://dubomebivenu.epizy.com/25777129193.pdf
    • http://bokapakubab.epizy.com/94360634669.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001118d.bin
db0c52ca3c8cfd450d5eddfc4a23fc4b4c5a5bcba4b427bf87fe207517662b27		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1118D 5400 bytes
font_01_sfnt_off00012415.bin
dd87658c367af8b82b2926e62d9b2a07911da9ddff99e0859aa6c5d73acf27ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12415 11096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.