Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ced8247575aa28c…

MALICIOUS

PDF

108.0 KB Created: 2021-04-15 09:11:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 434c7114b10e386279d7d58548fcb0f5 SHA-1: 23ca881a1d27cb630847c28753187cdc28686706 SHA-256: 0ced8247575aa28c13925a03c30e9321dad112e499e1b33146441ccdf7e494a1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to manipulate search engine results or redirect users to potentially malicious sites. The primary malicious URL identified is https://botokaw.ru/strik. While no scripts were extracted, the presence of numerous external links and the ML classifier's high confidence score indicate a malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=glimpses+of+other+realities+book
    • https://cdn.sqhk.co/fuvebopeweb/jjiahiB/jaxaliboluwesukivuno.pdf
    • https://cdn.sqhk.co/denirinodo/jgW2jcf/cross_stitch_flowers_simple.pdf
    • https://cdn-cms.f-static.net/uploads/4410194/normal_60611985cbf4c.pdf
    • https://cdn-cms.f-static.net/uploads/4459929/normal_604951b183bbc.pdf
    • https://gepadagonuvo.weebly.com/uploads/1/3/0/7/130775626/2280978.pdf
    • https://gupoxebexu.weebly.com/uploads/1/3/4/3/134337811/6250229.pdf
    • https://cdn.sqhk.co/rawegili/jjdhdig/collocations_make_and_do_worksheets.pdf
    • https://cdn-cms.f-static.net/uploads/4405902/normal_6014b3efad3c8.pdf
    • https://cdn-cms.f-static.net/uploads/4418362/normal_604a8bde7efde.pdf
    • https://cdn.sqhk.co/pasezateda/jdTjehe/run_rudolph_run_song_bryan_adams.pdf
    • https://cdn-cms.f-static.net/uploads/4382617/normal_604eafc65f7e4.pdf
    • https://cdn.sqhk.co/jodariwem/GJb6hen/63463803362.pdf
    • https://cdn.sqhk.co/nakotuba/jajjCns/mad_rock_drifter_climbing_shoes_azul.pdf
    • https://dakubazelup.weebly.com/uploads/1/3/1/4/131454222/xulaguxafewagabewo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/22056e4b-b3fc-4133-b4ab-b5f9cd187def/platos_republic_book_8.pdf
    • https://uploads.strikinglycdn.com/files/6dbd497b-7b38-4115-8a2a-e3f38294b7b8/28593283644.pdf
    • http://sebubexegan.rf.gd/biomaterials_a_basic_introduction.pdf
    • http://sonubadu.epizy.com/contaminacin_del_aire_en_mexico.pdf
    • https://uploads.strikinglycdn.com/files/9af2e0c8-2140-4e55-ac9b-73dcb6f6e864/nupetisunatu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00018847.bin
63f1d71cc0b50b996588efc85ae762f4ff159f91378a8d09e7451e64c53cc4d4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18847 17260 bytes
font_00_sfnt_off00011632.bin
e399a5f62fdd4d1ab448dc801145e84801110f3c0af9f8d161215b6e3e9521e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11632 6888 bytes
font_01_sfnt_off00012756.bin
fb322eb14ce2e7c79241267b0bdef89f68291010871eb382868b609ecf8c35d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12756 7828 bytes
font_02_sfnt_off000141cb.bin
c7c5b2ec22e1353b3c283c21374009c3e9df9b7a620b539648700dac69b9f258		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141CB 5376 bytes
font_03_sfnt_off000153e4.bin
52672549b30d33335cbf6a44d27a4886922072dcc53a7af776f446136f0b5ff2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x153E4 16032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.