Malicious PDF — malware analysis report

Static analysis result for SHA-256 5233d410d2d774b8…

MALICIOUS

PDF

79.7 KB Created: 2021-03-14 16:41:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 91a80e14f2589dc46cb2fccedfd2d290 SHA-1: 133626628e80958a70be1b8c9d0de620222d77a8 SHA-256: 5233d410d2d774b88ac17a55b26bac896cf0bcdfdabd5c20f4f1779ef055cea8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The primary URL, 'https://botokaw.ru/strik?utm_term=how+to+study+for+usmle+step+1+old+img', suggests a phishing or scam attempt. ClamAV detection and ML classification further indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+study+for+usmle+step+1+old+img
    • https://bexusisase.weebly.com/uploads/1/3/4/5/134596812/mawixujum_forumufekabubaw.pdf
    • https://tulopesonu.weebly.com/uploads/1/3/5/3/135318186/zilukime_bugewimewez.pdf
    • https://cdn-cms.f-static.net/uploads/4428035/normal_5fd13a3e64c81.pdf
    • https://static.s123-cdn-static.com/uploads/4449424/normal_6006441ab700c.pdf
    • https://static.s123-cdn-static.com/uploads/4489730/normal_5ff90bad8fc50.pdf
    • https://static.s123-cdn-static.com/uploads/4418401/normal_5fcf05024e25a.pdf
    • https://cdn-cms.f-static.net/uploads/4475730/normal_6015fdbc327ae.pdf
    • https://cdn-cms.f-static.net/uploads/4481516/normal_6037011f5c121.pdf
    • https://static.s123-cdn-static.com/uploads/4448115/normal_60056418290e6.pdf
    • http://guwejusu.22web.org/18230426676.pdf
    • https://static.s123-cdn-static.com/uploads/4410703/normal_5ff3a115451d8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4ed4990b-2a86-4347-bee0-58fed3462ea2/11127061187.pdf
    • https://uploads.strikinglycdn.com/files/cb2c84b3-323c-4442-a5ff-a3b5c718a85f/learn_python_crash_course.pdf
    • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_b1e4ef77664f412f8e5ea8f967f3ddcc.pdf?index=true
    • https://f516a5e5-1936-4b34-b436-a929b3a34b8d.filesusr.com/ugd/774001_d09a5b9d8c674b4abdae2633e1584613.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b47fa06c-b527-4d7d-8b08-e752db83ffda/sudanod.pdf
    • https://13ea8442-998f-4f14-ba3b-7f37e53a414c.filesusr.com/ugd/008a9f_4e546ccea28148cd8711a68d3e358ecb.pdf?index=true
    • http://vubimebuno.rf.gd/someone_like_you_lyrics_and_chords_van_morrison.pdf
    • http://xaramoturowuf.rf.gd/costco_subaru_pressure_washer_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb2e.bin
23624924fda8eea7baadfdf5713c5e583198c83aa76d9cd35ccf2ef75f56ab8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB2E 5356 bytes
font_01_sfnt_off00010d71.bin
cc480bad2cc8c3347aaefb65cfc14ce53ebd7f09d9cc1bcccede32c645ea6d6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D71 10592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.