Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a211adbae75aaea…

MALICIOUS

PDF

80.6 KB Created: 2021-03-08 04:34:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe932294b2c6a4e555136372b651075d SHA-1: ffd1a160328d619d2788c3b697734818b3dcc40e SHA-256: 8a211adbae75aaead6981d10d7dc13b615d983083db4081cf6b146cffbb7c29c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary URLs, 'https://botokaw.ru/aws?utm_term=what+age+group+is+diary+of+a+wimpy+kid+books+for', is directly embedded and likely serves as a lure. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan. No scripts were extracted, but the structure suggests a malicious document intended to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=what+age+group+is+diary+of+a+wimpy+kid+books+for
    • http://bagabipum.iblogger.org/bildschirm_drehen_android_app.pdf
    • https://vogifidawavuda.weebly.com/uploads/1/3/1/6/131636702/vazepu-bigaboxopatoki.pdf
    • https://timelasabo.weebly.com/uploads/1/3/4/3/134345700/706405.pdf
    • https://zujujoweb.weebly.com/uploads/1/3/5/2/135297083/c4b463.pdf
    • https://mujilaku.weebly.com/uploads/1/3/4/3/134389228/xajefefigu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2eda13a9-9e0f-47dd-bbfa-a9a5028a3314.filesusr.com/ugd/61c57f_0f4b290023eb4bc8bd13313ca2bafbfe.pdf?index=true
    • https://8772a198-af03-49ef-8724-5feb7546cb8a.filesusr.com/ugd/436f04_cf8e23bfcb9f44bea1e87b755a565b71.pdf?index=true
    • https://s3.amazonaws.com/bibejovixapis/smart_av_antivirus.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/preposition_worksheets_grade_4.pdf
    • http://nototen.epizy.com/filing_a_police_report_for_stalker.pdf
    • https://s3.amazonaws.com/nuvukivaxiren/how_to_reset_a_brooks_stairlift.pdf
    • https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_0f261f048d0c431ea861a86fc00fdc86.pdf?index=true
    • https://0f285ee0-1b14-49a2-8a3e-060a2db94812.filesusr.com/ugd/4bf67f_6aeb1c973d2242f08f0122e8b6fbfb53.pdf?index=true
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_98d9473bee2d4566984b97477a194633.pdf?index=true
    • https://e22e8d81-f41f-4d51-abb1-39b19d2d32bb.filesusr.com/ugd/96bf9d_8ea37c3df80e45c3827e1ac58562cab9.pdf?index=true
    • https://336ddc11-c37d-4cd6-9685-7accad2975f7.filesusr.com/ugd/479fa9_de57f67b75464d9ca1498ecf06f9e15e.pdf?index=true
    • https://3ecb585b-79b8-4502-8567-d9a17299c5c1.filesusr.com/ugd/4b874d_35c3e99d5a6c4ed7ab92c52c2827f9b6.pdf?index=true
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_e04cf80faf0f4f9aa845d4173a3bd35b.pdf?index=true
    • https://s3.amazonaws.com/lorerexeg/76656759500.pdf
    • https://s3.amazonaws.com/pulujolatepuv/barbie_dreams_audio_free.pdf
    • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_88bed6c2bcce447dab20a6d70bab642b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd20.bin
45540ca3e3bfdd5615efb76495e79fe10883fa6d8bc1d65374096460c3f2d28d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD20 5832 bytes
font_01_sfnt_off000110f5.bin
cccdbdf21765e27113d917d8195a56d1ad79b44fb1b200401d38f5bc6c5e1695		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110F5 10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.