Malicious PDF — malware analysis report

Static analysis result for SHA-256 3366a3c191b34240…

MALICIOUS

PDF

64.0 KB Created: 2021-03-11 19:28:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d6cbe558cd27cf48007785148398612e SHA-1: f43260ae876b7b5f3cd6ede15635ff73ba992b73 SHA-256: 3366a3c191b342409ae135be43e177adbe8da8ca03581ea02e74ef54f7054e18
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous external links, a common technique for SEO link farms and distributing malicious content. One of the primary URLs, 'https://botokaw.ru/award?keyword=all+formulas+of+maths+class+10+cbse+sa2+pdf', appears to be a lure, suggesting an attempt to trick users into visiting a potentially harmful site. ClamAV detection and ML classification further support its malicious nature, indicating it's likely a phishing or trojan distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6966

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=all+formulas+of+maths+class+10+cbse+sa2+pdf
    • https://cdn-cms.f-static.net/uploads/4375093/normal_602e0d897930c.pdf
    • https://cdn-cms.f-static.net/uploads/4450148/normal_6019021e97e26.pdf
    • https://cdn-cms.f-static.net/uploads/4369916/normal_601dfa127013e.pdf
    • https://static.s123-cdn-static.com/uploads/4457590/normal_5ff348fd8d1b9.pdf
    • https://static.s123-cdn-static.com/uploads/4366364/normal_5ff763ea646cb.pdf
    • https://cdn-cms.f-static.net/uploads/4405662/normal_60420100837f4.pdf
    • http://gegejobusi.22web.org/spring_framework_for_intellij.pdf
    • https://cdn-cms.f-static.net/uploads/4451205/normal_603a4df84d30d.pdf
    • https://cdn-cms.f-static.net/uploads/4425515/normal_603cffa2c39ed.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4a1cfc67-5981-466d-a13b-75576fe7431f.filesusr.com/ugd/64e449_bb23c1c3549542f09f114f0a4927eee0.pdf?index=true
    • https://80b1f93a-fe74-4439-a81d-34814fa7a505.filesusr.com/ugd/e56fe2_3c196d5c24534855a107c3a73a7ad3c1.pdf?index=true
    • https://4db61c00-1078-4917-8a1c-a2c1480eb6e0.filesusr.com/ugd/c94206_8bdd02d46adf464ab1dd1e82671e18fd.pdf?index=true
    • https://cc4f1b1a-08c7-467e-bb5a-e3073ad8caf1.filesusr.com/ugd/ffc175_f87447a476c74b91bb597512668cf0dd.pdf?index=true
    • https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_211070b120504466b39fea985441ee1f.pdf?index=true
    • http://bilexijo.rf.gd/android_5_delete_google_account.pdf
    • https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_1d0ceb9f40b5424dbe4f79ddc5cf9b5d.pdf?index=true
    • https://s3.amazonaws.com/gasodamuza/cpap_neonates_guidelines.pdf
    • https://s3.amazonaws.com/wexukufedepim/zanotazusejazaraguginise.pdf
    • https://s3.amazonaws.com/webipejonavuv/lokugamazuselojip.pdf
    • https://s3.amazonaws.com/fomudebipefasu/westminster_abbey_self_guided_tour.pdf
    • http://semisoriguregix.epizy.com/recette_par_quoi_remplacer_le_cognac.pdf
    • https://0926596c-b1e6-4473-87d6-fed2e709bfeb.filesusr.com/ugd/e2a635_9bbc31c021864a75a3420080e0cf5cc1.pdf?index=true
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_c8497dcfb0f9466389a04f7508a09e53.pdf?index=true
    • https://s3.amazonaws.com/neviwove/premiere_pro_cc_free_templates.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeb0.bin
04db63ac6275eb5a2af72895435b646ca82ac2af7da3537ce4ef535f7695a24a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEB0 5852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.