Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fb3dac6bd3061cb…

MALICIOUS

PDF

80.5 KB Created: 2021-03-24 12:04:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e0371aa48089e4a076c09c0e756a9e36 SHA-1: 12d556ab1ebc72c32c091bb69d8b340d673bb7d7 SHA-256: 4fb3dac6bd3061cb6362a927996e2c4896a40c73ec0fb89aefba8b3059da44bc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of external links, indicating it's likely part of a link farm or SEO spam campaign. One of the extracted URLs, https://botokaw.ru/strik?utm_term=navy+uniform+regulations+backpack, is suspicious and could lead to malicious content or further compromise. The document body is heavily obfuscated and contains metadata from wkhtmltopdf, suggesting it was programmatically generated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=navy+uniform+regulations+backpack
    • https://zowemuxojawoput.weebly.com/uploads/1/3/4/3/134357794/ce7ac82c.pdf
    • http://mutujejeturuduf.medianewsonline.com/net_technical_lead_interview_questions_and_answers.pdf
    • https://cdn.sqhk.co/renosopezare/bjaje03/wutugorixolavisilu.pdf
    • https://cdn.sqhk.co/wujakegu/ahepRih/91947311634.pdf
    • https://cdn.sqhk.co/tiwopaperuv/dhfNhjG/rufezako.pdf
    • https://cdn.sqhk.co/wepaxuwelusu/iiTragh/candy_crush_saga_on_facebook.pdf
    • https://cdn.sqhk.co/letarezetap/CqLhfN7/localizar_mi_android_por_gps.pdf
    • https://ribuborufexegax.weebly.com/uploads/1/3/4/5/134507127/68c13b0.pdf
    • https://xofezariro.weebly.com/uploads/1/3/1/8/131871505/demabevinogipuvalufa.pdf
    • https://cdn.sqhk.co/pekobenew/bibhhia/dogugesifazalisilevomos.pdf
    • https://cdn.sqhk.co/kexofodatop/hfbifOW/lesafipokelidizafo.pdf
    • https://dunufofobepo.weebly.com/uploads/1/3/4/3/134380723/mazupe-lojejewajanan-luxobopanadaze-godid.pdf
    • http://rivepozepuxar.mywebcommunity.org/pinavobatefikut.pdf
    • https://cdn.sqhk.co/janonaset/ieyjrfo/glow_air_hockey_apk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/sajatesawodiji/77718351610.pdf
    • https://ff5ab256-a407-4697-91b9-141751226614.filesusr.com/ugd/4205e4_c41f8b584a4f418ab9f881693e842899.pdf?index=true
    • https://s3.amazonaws.com/viwoxuz/sad_images_for_whatsapp_dp.pdf
    • https://3f5765b5-411c-4b28-96d1-a1e3b219bcee.filesusr.com/ugd/ca847e_6cc65b6b9eda4f3b8f0c064d65b066f9.pdf?index=true
    • https://s3.amazonaws.com/xulikamul/que_es_conocimiento_en_enfermeria.pdf
    • https://s3.amazonaws.com/nisiwanolom/pisiwetixorisux.pdf
    • https://722d0b64-886f-48d6-ad1d-3f240095bb95.filesusr.com/ugd/07f6b3_400c425f20174548a498c02384511944.pdf?index=true
    • https://s3.amazonaws.com/sitozi/mahindra_tractor_download.pdf
    • https://8dfd47f4-e591-4377-92a3-bdbf91d41e5a.filesusr.com/ugd/a58b01_4d7d36e406b84b3eab47fc22fc50b733.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeb6.bin
b0d8d3c977a5710e3854377f98503436b6e2df20e7eee187dde6fc2f022883d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEB6 5552 bytes
font_01_sfnt_off0001019a.bin
fd0c80a48e6c1996706eb0fe0500a5aa445272118dd2cec1fc4ce31dd072be96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1019A 10780 bytes
font_02_sfnt_off0001267c.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1267C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.