Malicious PDF — malware analysis report

Static analysis result for SHA-256 183362ccf8eaa6c2…

MALICIOUS

PDF

95.1 KB Created: 2021-05-27 10:16:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a73b546455a4c82bcf204ffae4bc9109 SHA-1: eb92f201a81ab73fa9fd1c497dc6a0b821367a3c SHA-256: 183362ccf8eaa6c2211dd387d4a7f634bff8fde8c2053c6eb6ef5a02bdb0e396
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which point to PDF files hosted on file-sharing services, suggesting a link farm or SEO poisoning attempt. The document body, though heavily obfuscated, contains a search query related to valuable Avon bottles, indicating a lure to attract users. The presence of multiple external URIs and a high ML classifier score strongly suggest malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=what+avon+bottles+are+worth+the+most+money
    • https://lotetirupaxep.weebly.com/uploads/1/3/4/0/134013035/fuwamivesowadodukoxa.pdf
    • https://cdn-cms.f-static.net/uploads/4450336/normal_6042c3899a449.pdf
    • https://fosaxobe.weebly.com/uploads/1/3/4/8/134882536/bajuje_jonijaxazo.pdf
    • https://getedizexagan.weebly.com/uploads/1/3/0/7/130740146/afbc6f10c21b3c7.pdf
    • https://static.s123-cdn-static.com/uploads/4492901/normal_5ffa4dd29483d.pdf
    • https://wusikizojig.weebly.com/uploads/1/3/4/8/134883510/volopewunux.pdf
    • https://cdn-cms.f-static.net/uploads/4384471/normal_602a18bf87ff5.pdf
    • https://static.s123-cdn-static.com/uploads/4418574/normal_5ff082c59d92e.pdf
    • https://kepowawovexe.weebly.com/uploads/1/3/4/0/134016687/mipuxixizupixagut.pdf
    • https://falababipudin.weebly.com/uploads/1/3/4/8/134847750/jekopofowamose.pdf
    • https://static.s123-cdn-static.com/uploads/4426572/normal_60082221c0625.pdf
    • https://dowusasetitemej.weebly.com/uploads/1/3/4/3/134307927/8593830.pdf
    • https://static.s123-cdn-static.com/uploads/4477400/normal_600734658d64d.pdf
    • https://cdn-cms.f-static.net/uploads/4495686/normal_600ed6051e17a.pdf
    • https://static.s123-cdn-static.com/uploads/4481839/normal_5fca9ae56f165.pdf
    • https://pudixibavumop.weebly.com/uploads/1/3/5/9/135964902/9676270.pdf
    • https://widalafamibag.weebly.com/uploads/1/3/0/8/130814492/30d31.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/618cef4c-0bf3-490c-97f3-ea45144531c4/how_to_pair_a_bluetooth_keyboard_to_ipad.pdf
    • https://uploads.strikinglycdn.com/files/332dcd3a-bc81-41c7-9cb7-77a924a94f00/71515470090.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013562.bin
50ae8f2dfb0b9478e98fe520cf9c7e40a869f482edf0b65e82c5c48d248fd7cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13562 5332 bytes
font_01_sfnt_off00014772.bin
8ba4dec1a52d6bafb54aeba6e61f69e1cd3a75d1fb95fe06ed62ba34b98a69ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14772 11216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.