Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a67a3b32ca68648…

MALICIOUS

PDF

79.7 KB Created: 2021-04-05 08:30:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 311ddf56561a928faf3dfd7ec63f205f SHA-1: d0e01f38f0a52b199b36cc8c8050c6243fbbf73d SHA-256: 1a67a3b32ca68648be2e2926260c4ff3dd8a9c47691e5f423832d679aa42efd0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The file contains a large number of external links, many of which are likely part of a link farm designed to obscure the true malicious destination. The primary malicious URL identified is https://botokaw.ru/strik, which is presented under the guise of 'data analysis tools better than excel'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=data+analysis+tools+better+than+excel
    • https://cdn.sqhk.co/rumoligodo/XidDqes/strange_exoplanet_names.pdf
    • https://tovawifigilad.weebly.com/uploads/1/3/0/7/130776196/rimipivit.pdf
    • https://cdn.sqhk.co/loxowopiv/gfsIYUm/takisadivilisepin.pdf
    • https://mepubigavij.weebly.com/uploads/1/3/4/5/134599646/b352873228a4ff.pdf
    • http://tonerinkstore.com/wikuxakekamexatopivapasog3ncr.pdf
    • http://prizinsta24.site/lavodakj7n2d.pdf
    • http://doucheop.xyz/awas_yojana_online_formahrv2.pdf
    • https://waziketezu.weebly.com/uploads/1/3/4/6/134648841/defavotosezop_xudamasetozu_nozen.pdf
    • http://apple-fruit.space/gipudofikudurewosogokulbr6f3.pdf
    • https://bosubunu.weebly.com/uploads/1/3/4/6/134693877/fa17404.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://53ee2ee6-42da-4c96-954f-60f726bc8d53.filesusr.com/ugd/de2744_7215ee6badc74f4caa440a4999c0e147.pdf?index=true
    • https://73856814-13bb-4d44-aeaf-752cce6ba6bd.filesusr.com/ugd/a0d21a_9dc08f71883a4eb0b24780e089082b76.pdf?index=true
    • https://s3.amazonaws.com/veledabejufi/31185846585.pdf
    • https://s3.amazonaws.com/tikofaketonub/how_to_hook_up_steering_wheel_controls_to_aftermarket_radio.pdf
    • https://s3.amazonaws.com/nitajosasa/janatha_garage_movie_hd.pdf
    • https://s3.amazonaws.com/xokebore/fawopazosowafuni.pdf
    • https://6cda4dd4-8aac-43e7-8003-7c0eea9f7907.filesusr.com/ugd/34e26e_4cd827c665614b80b6641e7c0034a7eb.pdf?index=true
    • https://s3.amazonaws.com/nitajosasa/how_to_use_standard_normal_z_table.pdf
    • https://s3.amazonaws.com/migivewuwe/ge_dinamap_v100_service_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e49f.bin
89f9fb0fd34e8461720f271b065cfd30318f0df9a283f23e08c6e9442efd9a91		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE49F 5196 bytes
font_01_sfnt_off0000f656.bin
ed8540525d02042a25e62811fa79d72ba159042068a918728eea51d0b245032a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF656 10620 bytes
font_02_sfnt_off00011aba.bin
4ef9506ee11a349461550e6b437e3786686b598308a87786035880d16624999d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11ABA 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.