Malicious PDF — malware analysis report

Static analysis result for SHA-256 024104a12327be84…

MALICIOUS

PDF

83.8 KB Created: 2021-03-25 18:21:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b09dc29a90aca6898489be4adcea6ce1 SHA-1: 235ca92540419dde80b6d36118ca5e475003834f SHA-256: 024104a12327be8420670d06f875632ebc76077ecc024b200b0217db164a6b05
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified as a link farm. One of the embedded URLs, 'https://botokaw.ru/wix?keyword=taiga+biome+animal+and+plant+adaptations', is flagged as unknown reputation, suggesting a potential malicious redirection or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=taiga+biome+animal+and+plant+adaptations
    • http://zavodtriumf.com/7755528744bp3gk.pdf
    • http://uspehdnyaaxyz.xyz/728234260g6n3h.pdf
    • http://fiselijuduguge.iblogger.org/89232976981.pdf
    • http://dreamingdeveloper.com/rukipojatqn.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_baff546298a74800ace7b1635b29fced.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0f2c405c-16ca-4317-9423-90f5f84c285f/vadum.pdf
    • http://besubavivexuva.epizy.com/monitor_cardiaco_speedo.pdf
    • http://gulopajekojof.epizy.com/fejejoku.pdf
    • https://uploads.strikinglycdn.com/files/7c167c38-c5d8-4514-9072-6e8526e9f5a4/what_is_the_blood_test_called_for_crp.pdf
    • https://db244590-af71-4c33-bd6e-2f8f55f31281.filesusr.com/ugd/fdab61_cbde9230cae6483e8f23a4b9062c47e3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a6b12e78-a939-462f-ac11-5ab67b862244/color_a_course_in_mastering_the_art_of_mixing_colors.pdf
    • https://uploads.strikinglycdn.com/files/1abc5d58-58c1-4836-b8be-87f67fc37d70/5604458987.pdf
    • http://buzawasilugije.epizy.com/65777929580.pdf
    • https://29ca30ec-7ad4-487f-8637-d2d67f3a323c.filesusr.com/ugd/10b11f_5b973a57094f44b5b47f752726bfa2ad.pdf?index=true
    • http://tusavubifitivik.rf.gd/robert_dahl_on_democracy_summary.pdf
    • https://631ffb88-cf2d-4844-8d6b-9338a1b21cc5.filesusr.com/ugd/d24e6f_6b979899b2ad44fb9bc3e3e9503ab323.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9faa3b34-6261-4a74-9ab4-1dcb6108eb8a/family_therapy_techniques_minuchin.pdf
    • https://92fa68c6-d088-48c5-94d9-776fe0504fc0.filesusr.com/ugd/5a053b_3895494ae26549e2a1c5a5b828216292.pdf?index=true
    • https://5b2b9875-3923-4577-9ef6-0527498c95e7.filesusr.com/ugd/4e6dd5_b968c1474923466b821896f8c6f1d5b8.pdf?index=true
    • https://181f3bdf-810f-4c34-abb3-9f3362228cd6.filesusr.com/ugd/30415f_11d83fcb47434a03bdc528cfbfc53c9b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9cabd239-6c65-41fd-b0b8-a2380e04b10f/can_sound_freeze_water.pdf
    • https://uploads.strikinglycdn.com/files/2cc14880-235c-4b61-8f8c-6e304ee20288/what_is_the_best_hotel_booking_site_in_canada.pdf
    • https://923a8ca3-316b-4844-b38f-9bc955ad4852.filesusr.com/ugd/312e0e_08fbd119a77c450f9298103327da09d9.pdf?index=true
    • https://8aefc570-8454-48c3-bb63-d4d1067b7ce0.filesusr.com/ugd/5c9621_a5602b787fb14382b4108c5314bff084.pdf?index=true
    • https://uploads.strikinglycdn.com/files/831f9a66-a745-40a1-99f1-283553d899fe/pejibixinopofejokitisu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000108c8.bin
b1f8600b14b230ab20dcb58ba698651e12793122abf6cc2fb0357c1efeca3c25		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x108C8 5272 bytes
font_01_sfnt_off00011aa1.bin
68c1cd1cbdb03cec325321dd407ebe0eb46e5fb04c7e290287b288a580f69e68		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AA1 10772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.