PDF malware analysis — malicious · 7d37fea51db5d96a

MALICIOUS

PDF

69.7 KB Created: 2021-03-30 19:54:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27

MD5: e7ab6f5967093e9a73fe61416e1904e8 SHA-1: 37b360c7a5d9b7221452506735895a7c896adfca SHA-256: 7d37fea51db5d96addd8dd7ad431954261af88bc7c1741c6faec51ed7608ed8f

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The document contains numerous embedded URLs, with at least one pointing to a suspicious domain ('botokaw.ru') that is likely used for distributing malicious content or phishing. The presence of multiple links on disposable hosting suggests a link farm designed to obscure the final destination. No scripts were extracted, but the overall structure and URL distribution strongly suggest a malicious intent to redirect users to harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/123?utm_term=sivir+guide+probuilds PDF link annotation
- http://bibivire.mygamesonline.org/kevaxejad.pdfIn PDF document text
- http://pimesizawox.sportsontheweb.net/akai_mpk_mini_manual.pdfIn PDF document text
- http://salimom.mygamesonline.org/libro_de_frances_adosphere_1.pdfIn PDF document text
- http://wuramegojuluz.mywebcommunity.org/zopixoj.pdfIn PDF document text
- http://tujijamutibe.sportsontheweb.net/what_is_my_deepest_fear_poem.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://wowutuzineko.myartsonline.com/84265800127.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/82af4f69-db3d-45d3-a314-3edadc7209d8/you_can_negotiate_anything_book_in_tamil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ab720cdc-0489-46b3-b87e-c1fcf6122b16/80909434045.pdfIn PDF document text
- https://99b08629-27b2-41dd-83a1-938dc2ca35bd.filesusr.com/ugd/067ecb_2881a94943494e7d9369e4c20dc7896e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tenunud/benzene_reacts_with_bromine_to_form_bromobenzene.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f20538a3-2ba1-4010-8736-739faeec073b/38372185191.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/434730fe-01a4-41c6-aad5-2e01e153d5c4/where_can_i_learn_photography.pdfIn PDF document text
- https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_a262cabfde2049b08c3742e903ae7464.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3c8d59b3-70a6-4b9a-b745-737df931630d/rodirotitokudo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f87a9c3-0ed3-4b37-9593-ea8bd3514537/hp_deskjet_1512_ink_-_tesco.pdfIn PDF document text
- https://s3.amazonaws.com/zidenigad/64643143346.pdfIn PDF document text
- http://zupitatip.atwebpages.com/puvovoxuguxokidemotebogi.pdfIn PDF document text
- https://8ed7b8cb-9bae-4def-ad9b-66b28cd11f91.filesusr.com/ugd/740d8c_47a24a22a29842e2a102b75ad0472c7d.pdf?index=trueIn PDF document text
- https://15e12281-0fef-4bb1-b284-2b61ddec1698.filesusr.com/ugd/6c5390_91b4078e809e49ffb4b6a53a3249707d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/welanisowari/acid_pro_7_authentication_code.pdfIn PDF document text
- http://nevabaza.atwebpages.com/computer_basics_absolute_beginners_guide_windows_10_edition.pdfIn PDF document text
- https://s3.amazonaws.com/dewutexorob/shatta_wale_amount_video_free.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d391.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD391	5220 bytes
SHA-256: `bdb2970b516401ff1444f37507a24dd1fdce9b9ddfb708a831863b63a4e35d8c`
`font_01_sfnt_off0000e566.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE566	10556 bytes
SHA-256: `8a0157bce1ce39826a750d71d89df579dd9f97a888277854f2bf75ccf411bd12`

Open this report in the interactive analyzer, or submit your own file for analysis.