PDF malware analysis — malicious · 47de20377d92eb81

MALICIOUS

PDF

76.2 KB Created: 2021-03-31 11:49:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: 6833d016a83a6d127991de62a0af94b3 SHA-1: 5a9239121d83f4798124c6cce125b3c26b12c97f SHA-256: 47de20377d92eb81fb491469114ceb9d71a66be203afbbf64bb08e4d25c27ced

164 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The presence of a mass external link farm heuristic and an embedded URI pointing to 'botokaw.ru' suggests a phishing or malware distribution attempt. Although no executable scripts were extracted, the overall structure and heuristics point towards a malicious document designed to trick users into visiting a potentially harmful URL.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/123?utm_term=nomao+camera+x+ray+app+free PDF link annotation
- https://cdn.sqhk.co/difanemifal/drJjjbT/dj_sound_effects_2019.pdfIn PDF document text
- http://chempion.coffee/kemomemaxigiwepadeson6ofhj.pdfIn PDF document text
- http://keep-travel.com/food_maker_beach_partydg3gc.pdfIn PDF document text
- https://cdn.sqhk.co/mowukirew/fKjcHEI/14240349580.pdfIn PDF document text
- https://cdn.sqhk.co/fawabanof/hbdcjhf/85103761119.pdfIn PDF document text
- http://albl.ru/what_documents_do_i_need_to_renew_my_license_in_njb7tny.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/goveruduzewoxu/echinococcus_granulosus_guidelines.pdfIn PDF document text
- https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_b35b5c50ac2e4f4390d79ab31cd455ce.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xufoxorog/93531442125.pdfIn PDF document text
- https://s3.amazonaws.com/jolituzoji/microcenter_open_box_fee.pdfIn PDF document text
- https://s3.amazonaws.com/bamepofewalada/10244517170.pdfIn PDF document text
- https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_25ed7636617c4b12803bd74e69cc9451.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wixanarer/20216142395.pdfIn PDF document text
- https://da5bec28-7969-4117-8ffb-5069fce5e80c.filesusr.com/ugd/31593d_4207029a0e584832ae4f949aea32c89a.pdf?index=trueIn PDF document text
- https://5be7aec3-7d66-433b-ae1d-2bfb807ddf2a.filesusr.com/ugd/24deb6_1836c4b0af194bdf9a43131cc8ccab44.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nolarifaforuxop/12481372886.pdfIn PDF document text
- https://s3.amazonaws.com/rezugekolaba/bodybuilding_chest_workout.pdfIn PDF document text
- https://s3.amazonaws.com/xoguwavosuje/white_melamine_plywood_sheets.pdfIn PDF document text
- https://a0a5ada1-270c-452f-b092-d943fc6f0dc0.filesusr.com/ugd/306762_39f1f20adf2a42f6a49c62d705ca801a.pdf?index=trueIn PDF document text
- https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_29fd5ae0bf384f7f942a951c65d2c1ef.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nafibanefexex/16375390505.pdfIn PDF document text
- https://19d8af67-ac20-4a7c-8ffd-69be953788a8.filesusr.com/ugd/578741_12346d02f0514d6bba11b8240d0a56e6.pdf?index=trueIn PDF document text
- https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_826bb14c1027439494cd5f47462314a5.pdf?index=trueIn PDF document text
- https://c546c886-5aa5-41cc-813f-4ed3e146772c.filesusr.com/ugd/b3e52d_5eb63e0c232d4761b518f3ae5369d8c4.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb6a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB6A	5092 bytes
SHA-256: `a8d2979d4eeafe1d4ab459eac13ac5a3a54575094a3c9cf43b75c9025048d4a8`
`font_01_sfnt_off0000fcb9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFCB9	11380 bytes
SHA-256: `8d64a118c003fcd9343eb3da5405ee899a43a872c6e200d5e587fbc7152cf2f3`

Open this report in the interactive analyzer, or submit your own file for analysis.