Malicious PDF — malware analysis report

Static analysis result for SHA-256 3915a4346d783f54…

MALICIOUS

PDF

85.1 KB Created: 2021-03-24 14:59:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c587088a837c55887fe12b023a2c3a99 SHA-1: 6429d3fdb73baf58db4132332cfe96887a7d74d7 SHA-256: 3915a4346d783f543073015692417cd68c3537cb1fcffbf23b5c8030cf684497
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, many of which are to PDF files hosted on file-sharing services, suggesting a link farm or redirection mechanism. One embedded URI, 'https://botokaw.ru/123?utm_term=best+haute+route+ski+guides', is particularly suspicious and likely leads to a phishing or malware distribution site. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure points to a malicious document designed to trick users into navigating to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=best+haute+route+ski+guides
    • http://hs-life.ru/kyocera_ecosys_m5526cdw_manualemjvow.pdf
    • http://pigalimiru.medianewsonline.com/smallpox_and_bioterrorism.pdf
    • http://drnextact.xyz/john_kingdon_3_streams8rhjh.pdf
    • http://barashik.space/fetal_distress_adalahg6q0n.pdf
    • https://static.s123-cdn-static.com/uploads/4428078/normal_5fc6bd98484c1.pdf
    • http://balifruit.com/virginia_woolf_the_waves936qj.pdf
    • https://cdn-cms.f-static.net/uploads/4481163/normal_60492fcd92e4e.pdf
    • http://xijulefabogi.getenjoyment.net/partes_de_un_motor_de_corriente_directa.pdf
    • http://rozujed.sportsontheweb.net/22081832759.pdf
    • http://rasezatoxefu.mygamesonline.org/home_security_cameras_with_iphone_apps.pdf
    • http://paxezimusosesa.scienceontheweb.net/harry_potter_book_3_quiz_hard.pdf
    • http://decideyouself.fun/samsung_music_player_old_version_app_download2okqt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c69a8150-bb1e-4c46-878b-fc1622391bd7.filesusr.com/ugd/cf91d6_d3f805ac58bf42dda1e8589e79fe309f.pdf?index=true
    • http://nabenejajoko.myartsonline.com/93772416479.pdf
    • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_77defa93ee1f4d6a80045cc21aeb9804.pdf?index=true
    • https://3fb740b9-71d8-4183-8edb-de11b68c0a29.filesusr.com/ugd/1fbf8b_c87b2a55dcb8441b9e4f60174e9cb7ec.pdf?index=true
    • http://vilepobafomunow.atwebpages.com/gobevuvomodusuzofifiredux.pdf
    • https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_f14b106dc223456ab153c13862b18771.pdf?index=true
    • https://933afb0c-60ca-4ff4-ba38-e7c804ca925d.filesusr.com/ugd/941881_9e7b493cf8be4e78ad767a58e15e288d.pdf?index=true
    • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_331610c295a943edbc7dcef0d035773f.pdf?index=true
    • https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_e63a5d7364584128bd3e25dc6d4edde7.pdf?index=true
    • http://baxewape.myartsonline.com/menixusutizakusajozino.pdf
    • https://af6bd0e1-9fb2-4c52-b6e5-df6188d17e94.filesusr.com/ugd/771d18_d80c776876e94533a88711e56d257f86.pdf?index=true
    • http://zupitatip.atwebpages.com/18361012217.pdf
    • https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_80ab1437062644c09be6c21b2b9c8e57.pdf?index=true
    • https://393102e6-89af-4738-8cad-89662dba8dc5.filesusr.com/ugd/33a16d_070e33330b7c45039081eb24dccd9d07.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e58.bin
e7fb5a696c71fcaace0761405435e092c232b2c101a0482f7f0b99e2a0d9263c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E58 5168 bytes
font_01_sfnt_off00011fed.bin
dbcbb56b383ef52b37e34b28db3e02255a53c613920486f24024f7c928b7ea48		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FED 11124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.