Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e10a29ee358b924…

MALICIOUS

PDF

76.8 KB Created: 2021-04-04 22:02:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68c868292ecde8cf9647ca7c8b40b6e1 SHA-1: 7f04c6fecf2e3359f2f7ecb5e14afdd6aa7cd152 SHA-256: 6e10a29ee358b92471981438a879c2a7892e27ee5c13ff2fe5727ab09a2a2e69
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with a critical heuristic firing for a 'PDF_SEO_LINK_FARM'. One of the embedded URLs, 'https://botokaw.ru/123?utm_term=run+audit+trail+report+quickbooks', suggests a potential phishing or SEO manipulation attempt. The ML classifier and ClamAV also flagged this PDF as malicious, indicating a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=run+audit+trail+report+quickbooks
    • https://cdn.sqhk.co/malevevipali/a5heShh/pedal_afinador_boss_tu-_3_chromatic_tuner.pdf
    • http://nanolenka.xyz/aruba_clearpass_guest_configuration_guide5g584.pdf
    • https://cdn.sqhk.co/bozomixega/aGRsMo9/anger_of_stick_4_para_hile_apk.pdf
    • http://vir-tus.com/can_samsung_s9_battery_be_replaced0ypzx.pdf
    • http://spiritstudio.ru/how_to_change_android_starting_logonomba.pdf
    • http://mixed-rootwork.com/purchase_requisition_letter_template5xwao.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fakuguvil/mahatma_gandhi_biography_book.pdf
    • https://d6a293f2-6876-493d-91b7-c13182b05023.filesusr.com/ugd/bcaa7e_cf56e86102094531b382dc2d9d4814ab.pdf?index=true
    • https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_359606c6d52947499cb3fb96f57bd990.pdf?index=true
    • https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_a926d39062e74a73bd8e82f817e97595.pdf?index=true
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_8ca2ae3dc5bd4ff1a439c32e28585d10.pdf?index=true
    • https://8aefc570-8454-48c3-bb63-d4d1067b7ce0.filesusr.com/ugd/5c9621_378f9ec36d0f48e8b7cb0738a59e9f92.pdf?index=true
    • https://s3.amazonaws.com/gurafoga/3779980272.pdf
    • https://s3.amazonaws.com/loranoduzuja/ponamobemopiwopunokeba.pdf
    • https://s3.amazonaws.com/zuxime/nupumulaxivisuxomomaj.pdf
    • https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_9d3ea96b87f0465a82fd2d548284a8bb.pdf?index=true
    • https://c2093f15-f4fb-4bda-9582-db5404103fa6.filesusr.com/ugd/b28561_aff1126b3fee4954840c07581fe4f9bf.pdf?index=true
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_c8c8ba14047146a78c0bb760843dcc9a.pdf?index=true
    • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_006b6f2ba2df4b32979a56c7cb648293.pdf?index=true
    • https://6c49ff76-e13b-46da-8354-2e633d56f736.filesusr.com/ugd/211c2d_3b749ed994c64cccba2d95b5c063c931.pdf?index=true
    • https://184d393c-d2ff-49e5-bbcb-48626b1dbf88.filesusr.com/ugd/49be48_8d8cbbe7f18b472792784141adf281db.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec3d.bin
d7b801c63feb947a09472f57ab5fe9c273e3bd169187d1fa20675b76adcfc707		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC3D 5404 bytes
font_01_sfnt_off0000fea5.bin
da5226a12ae87743c695ac5920e76792a59345d8035aa2ffd4ddcbba1d474e27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEA5 11588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.