Malicious PDF — malware analysis report

Static analysis result for SHA-256 382c04e9e9e9e563…

MALICIOUS

PDF

86.9 KB Created: 2021-03-10 13:33:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: eb945958a12730a016c71966d3940380 SHA-1: 384a55b49bad0274c54477cace667c26fe1a76c6 SHA-256: 382c04e9e9e9e5632f5ef3a03ed1e3eb71a1a2a7f98f1f2c11c094956cd61ea1
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to domains associated with link farms and potentially malicious content, as indicated by the PDF_SEO_LINK_FARM heuristic and ClamAV detection. The ML classifier also strongly flagged this PDF as malicious. The primary URL, https://botokaw.ru/strik, appears to be part of a phishing or malware distribution scheme, disguised by a seemingly unrelated topic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=does+evening+primrose+oil+really+work+to+induce+labor PDF link annotation
    • https://cdn.sqhk.co/purovufizu/LgeYfBe/65098566094.pdfIn PDF document text
    • https://cdn.sqhk.co/lisupixiwe/eihngcp/vinted_buy_sell_swap_fashion.pdfIn PDF document text
    • https://cdn.sqhk.co/sosexazefip/geckMje/tevezijanedijod.pdfIn PDF document text
    • https://cdn.sqhk.co/gulofiji/aLp9ggn/26678992911.pdfIn PDF document text
    • https://cdn.sqhk.co/letinumi/achbLje/ez_load_snowmobile_ramp.pdfIn PDF document text
    • https://cdn.sqhk.co/sinonari/6Tge3jj/packer_game_live_now.pdfIn PDF document text
    • https://cdn.sqhk.co/fabokofe/ifigOgh/tips_survival_minecraft_pe.pdfIn PDF document text
    • https://cdn.sqhk.co/telazaje/i39iatH/36981961298.pdfIn PDF document text
    • https://cdn.sqhk.co/lididiregi/ijnu2je/beast_bendy_coloring_pictures.pdfIn PDF document text
    • https://cdn.sqhk.co/pojizurigos/VhhxX1Y/dilulurur.pdfIn PDF document text
    • https://cdn.sqhk.co/keximovib/gifTShb/pocket_colour_wheel.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/likadojivivofu/25146093904.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/central_venous_catheter_care_guidelines.pdfIn PDF document text
    • https://21a67f6d-2aea-439f-a910-ed4feb6be009.filesusr.com/ugd/173616_153094b090064d048aabdd63202ef2f3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/mn_hazmat_endorsement_study_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de3e9b12-457f-4595-896f-c073f09803eb/20737345892.pdfIn PDF document text
    • https://4a7d9d2b-1d67-446c-8d6d-bdd3043d1f60.filesusr.com/ugd/c3d078_17db659d5b5f4e88af8ab8950c205399.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c37b53de-9879-46cb-a3d4-4fdbd58deaf0/atem_tv_studio_setup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9991bdce-928d-46bc-b041-f195122bfc3e/17820909224.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/208ae8a3-b973-4caa-ab5a-620aee28c186/84611081720.pdfIn PDF document text
    • https://s3.amazonaws.com/difigomisosak/36659680399.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001021a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1021A 5852 bytes
SHA-256: f841b514f02cd10382011e652e551efe1b7246c724b097bb34454e985ff36120
font_01_sfnt_off00011614.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11614 10168 bytes
SHA-256: f050d13ea68d23442def4755ef4d177fbfb0dc0af8d207f5f743db529abc1f5e
font_02_sfnt_off0001390d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1390D 16060 bytes
SHA-256: 5b45d8957cdd618c0f157c507058aef1810e6158bb3d1abf257796d6008f54d1

Open this report in the interactive analyzer, or submit your own file for analysis.