Malicious PDF — malware analysis report

Static analysis result for SHA-256 682034681428a6bc…

MALICIOUS

PDF

80.0 KB Created: 2021-05-12 02:34:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: f0394a665f75031c2886804d4a6eec59 SHA-1: 2457cee2e840b0786ada7e80de5b9225eded9f29 SHA-256: 682034681428a6bc43ebd79c0afb0bcbe950d59b8156b4ef3df648d986e1a7f4
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or phishing operation. One prominent URL is https://botokaw.ru/strik?utm_term=the+essene+gospel+of+peace+review, which is likely a malicious redirector. No scripts were extracted, but the PDF structure and numerous external links indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=the+essene+gospel+of+peace+review PDF link annotation
    • https://lizakefamejoxen.weebly.com/uploads/1/3/1/3/131384135/3da2b96a4.pdfIn PDF document text
    • https://bafokaxaxex.weebly.com/uploads/1/3/4/8/134881351/kabeminoke.pdfIn PDF document text
    • http://niluwipewuxasa.medianewsonline.com/25807769956.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464078/normal_5fdbdf7ec9a89.pdfIn PDF document text
    • https://rodifeganugupi.weebly.com/uploads/1/3/2/8/132815003/11627ccfa499.pdfIn PDF document text
    • http://nizavevorupuj.mywebcommunity.org/how_many_calories_does_an_ear_of_sweet_corn_have.pdfIn PDF document text
    • http://xuxodowenam.getenjoyment.net/belief_tab.pdfIn PDF document text
    • https://tijoteveduno.weebly.com/uploads/1/3/4/8/134853829/3662637.pdfIn PDF document text
    • http://segaruzobuguses.scienceontheweb.net/lost_ocean_coloring_book_review.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374976/normal_604a92166b3aa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://7f1888b6-cdab-4603-9914-1cf81a8b29aa.filesusr.com/ugd/6846fe_74c9e560b8e4419eb5f0de0577b5f900.pdf?index=trueIn PDF document text
    • https://73856814-13bb-4d44-aeaf-752cce6ba6bd.filesusr.com/ugd/a0d21a_770c94bf69154df5a75b9766b75fd5c8.pdf?index=trueIn PDF document text
    • https://ba428ff1-d53d-4eb5-bdb2-cc960067f420.filesusr.com/ugd/7041e4_2aa149327c684bbe835d0170325085a7.pdf?index=trueIn PDF document text
    • https://8c17aa34-c454-4d6c-a218-8929c845e329.filesusr.com/ugd/808cd0_d6e48e0c87f642159b9fd01f3b9039b3.pdf?index=trueIn PDF document text
    • https://0315d410-4255-45a3-9477-873949dd02ac.filesusr.com/ugd/f85006_e6a24df352964be8bfe214ef0baf799e.pdf?index=trueIn PDF document text
    • https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_08aa933509be45709a27f7c3159144cc.pdf?index=trueIn PDF document text
    • https://75e6d08a-b14f-4c2c-bd4e-3e6431d9d11c.filesusr.com/ugd/497a87_a382fc782b8140a0ad66b4e399886ed5.pdf?index=trueIn PDF document text
    • https://b86313a8-447b-404d-ae6d-bc69740d899e.filesusr.com/ugd/e54fc7_3511865a28bb44f987e42038cdb8b93f.pdf?index=trueIn PDF document text
    • https://e924225a-aa46-4bfc-8e56-7341551e1833.filesusr.com/ugd/54dfea_82c60faab07a47489e3d9b10b6cdf48f.pdf?index=trueIn PDF document text
    • https://0778d94d-b67d-49c3-8f6f-43f52d6edec9.filesusr.com/ugd/b85eb0_fee871ae47c64c6481f392c72ad4e69c.pdf?index=trueIn PDF document text
    • https://57eba762-b826-4879-8d7a-7f480aba2934.filesusr.com/ugd/e89c2b_d82e6ca8fb5743709b337295ed37e189.pdf?index=trueIn PDF document text
    • https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_c21bbbdbbb374a3c9f8538a352a337c8.pdf?index=trueIn PDF document text
    • https://0fecb50d-c8db-4b5c-a67e-01a13b1c0e9a.filesusr.com/ugd/da7c2d_b0c72dc45f4c471ebfb78d1c31cae0d8.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e271.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE271 5376 bytes
SHA-256: 1e48a10bfec48509915f8bdb9eefbd4472df1c5bd3da59e4d25739e48547c9d6
font_01_sfnt_off0000f4d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4D2 11604 bytes
SHA-256: 012d834fc6f9d89ba1f665d8d48c195283ed6f0c5c9d0d9ede059edd25863f71
font_02_sfnt_off00011b3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B3C 16204 bytes
SHA-256: a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd

Open this report in the interactive analyzer, or submit your own file for analysis.