Malicious PDF — malware analysis report

Static analysis result for SHA-256 8106f32fb56a19c3…

MALICIOUS

PDF

92.4 KB Created: 2021-05-20 20:59:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7f32f86b0f928d37d232fbe1096f6e21 SHA-1: 609730b0cbf11a3abb66483b678e2045480142a6 SHA-256: 8106f32fb56a19c3266ea03d7b63a5c5ed3e21e2d2918189963a1d529f071747
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic indicating a link farm with numerous external PDF links, suggesting an attempt to manipulate search engine rankings or distribute content. One of the embedded URIs, https://botokaw.ru/strik, is flagged as suspicious and likely leads to a malicious site. The ML classifier strongly indicates maliciousness, and the overall structure points towards a content-luring or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+find+velocity+of+a+particle
    • https://zavodazokexa.weebly.com/uploads/1/3/4/6/134632977/serivunijila.pdf
    • https://fojefutitamok.weebly.com/uploads/1/3/3/9/133989463/958f82d4ff37e8.pdf
    • https://motikefivenigem.weebly.com/uploads/1/3/4/7/134709332/3041932.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tuzakifezara/53981253759.pdf
    • https://s3.amazonaws.com/lodazojamuva/que_son_las_bases_nitrogenadas_purinas_y_pirimidinas.pdf
    • https://s3.amazonaws.com/dexodekelaseki/borland_c_builder_6_full.pdf
    • https://uploads.strikinglycdn.com/files/34d03b18-a04d-4d8f-a7a1-5d306ffa4e35/agile_methodology_including_scrum_and_kanban_methods.pdf
    • https://uploads.strikinglycdn.com/files/d21c67c2-1666-4f10-b665-c37012ff2325/pijogogikavavanejob.pdf
    • https://s3.amazonaws.com/bomupi/berserk_manga_free.pdf
    • https://s3.amazonaws.com/tisegovofu/sasevofurifan.pdf
    • https://uploads.strikinglycdn.com/files/9521bb9f-cabc-4db8-820c-a418d92d569e/vagifagipaki.pdf
    • https://uploads.strikinglycdn.com/files/d0d98956-b6a6-4807-b5db-2017193d7016/duzej.pdf
    • https://uploads.strikinglycdn.com/files/f9d43b1c-dbf4-489e-8312-50709805e6a4/does_papa_johns_have_thin_crust.pdf
    • https://uploads.strikinglycdn.com/files/f3a4628e-3a5a-4c2e-95c1-3e88a4fb9a27/troy_bilt_tb575ec_fuel_line_diagram.pdf
    • https://s3.amazonaws.com/pilazi/idiomatic_expressions_worksheet_for_grade_8.pdf
    • https://s3.amazonaws.com/dedinavesute/proctor_silex_coffee_pot_manual.pdf
    • https://uploads.strikinglycdn.com/files/d9209be6-09c5-4136-a25d-90baf6eab0de/lexatakizajedufagituk.pdf
    • https://s3.amazonaws.com/rujabepifar/basic_accounting_mcq_questions_and_answers.pdf
    • https://uploads.strikinglycdn.com/files/f7b8b463-2ad1-45de-97dc-c3b52de16d53/how_to_reset_a_nextbook_to_factory_settings.pdf
    • https://uploads.strikinglycdn.com/files/e097da1a-41c5-4a2d-9011-f4b45a7c1c97/71156567915.pdf
    • https://s3.amazonaws.com/satuja/camtasia_user_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001121c.bin
1be6199db04a3cf87706c183e73308a2a96025a94ef15e3e6323a7145c7f0cf9
pdf-font-stream PDF embedded font (sfnt) at offset 0x1121C 5188 bytes
font_01_sfnt_off000123f1.bin
09487f7e8f19ef6e1e467fddc7a39adddd56a57fdfb353d07107a796f6cad71b
pdf-font-stream PDF embedded font (sfnt) at offset 0x123F1 11996 bytes
font_02_sfnt_off00014d6c.bin
365c24368114ad1357215bdb10d488652f6572b8635c3ddcd3785be6cada07f5
pdf-font-stream PDF embedded font (sfnt) at offset 0x14D6C 16116 bytes