Malicious PDF — malware analysis report

Static analysis result for SHA-256 2160440ed84aa081…

MALICIOUS

PDF

76.8 KB Created: 2021-04-12 23:15:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5aad2bfa064c678adae24cdd279da243 SHA-1: d20a5a2c8269aef8a03a353f405ffa1151a1e0f4 SHA-256: 2160440ed84aa0815c8126ab12f233954eee24dc3353a2297988da0cd34c855a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains a large number of external links, suggesting a link farm or redirection mechanism to malicious sites. The document body, though heavily obfuscated, contains references to 'business math calculator app' and 'wkhtmltopdf', likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=business+math+calculator+app
    • https://static.s123-cdn-static.com/uploads/4446638/normal_5ffe82b01bc71.pdf
    • https://cdn-cms.f-static.net/uploads/4367646/normal_606b7c97966d9.pdf
    • https://cdn-cms.f-static.net/uploads/4475739/normal_604079a085726.pdf
    • https://cdn-cms.f-static.net/uploads/4372673/normal_600f008fb8f28.pdf
    • http://tikopariwoxa.mygamesonline.org/capitalism_worksheet.pdf
    • http://lubozamesorox.iblogger.org/is_amazon_rainforest_an_ecosystem.pdf
    • https://cdn-cms.f-static.net/uploads/4453885/normal_601b380d8b641.pdf
    • http://gagefiwirimat.medianewsonline.com/gakojisuzowibajoke.pdf
    • https://static.s123-cdn-static.com/uploads/4465274/normal_5ff2f6cd444c2.pdf
    • https://cdn-cms.f-static.net/uploads/4421943/normal_5fd09fae6a7ab.pdf
    • https://cdn-cms.f-static.net/uploads/4479715/normal_6017c23fe3a3a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dixaleko/boy_scout_store_oakland_new_jersey.pdf
    • https://s3.amazonaws.com/wutogugej/audacity_export_midi_to_wav.pdf
    • http://kusotuwomaru.epizy.com/79814801447.pdf
    • https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_ef87f8bd49094b709854f5425082e1c9.pdf?index=true
    • https://s3.amazonaws.com/daraniwekamidir/bride_of_the_century_episode_10.pdf
    • http://suxazetevuzo.onlinewebshop.net/99593479457.pdf
    • https://s3.amazonaws.com/pirofopafu/49341008883.pdf
    • https://92923600-264c-4cb8-9d87-181083d4f0d6.filesusr.com/ugd/0bf43f_c4e5ff7dd9c6435f8fcf6d6b70fe6ec3.pdf?index=true
    • https://bb209e34-24c3-4901-88bd-c00af8cda710.filesusr.com/ugd/de6798_0ef7da169afb42808d229eaa7a453ccf.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000effe.bin
f93035ebcfcd3f5ce66eade6c555dce0f81a1673c96d68bb418fd7c0f3c98ced		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFFE 5224 bytes
font_01_sfnt_off00010193.bin
860e52ce317b8d76f7d26732efa9718df82e3d6135f76e7ea33d52a4be22f209		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10193 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.