Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a1dc46e571c47b8…

MALICIOUS

PDF

94.7 KB Created: 2021-04-04 22:14:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3abb27aa5a48d073b4dc58d7be1241e5 SHA-1: f5c472028ba0f49cb7427fadc9e70859a206def5 SHA-256: 9a1dc46e571c47b89844e70290686fe7e7c2aa07a4a981464bd995baf35519c2
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by an ML classifier as malicious. It contains numerous embedded URLs, with one specifically pointing to a suspicious domain ('botokaw.ru') and containing a 'utm_term' parameter that appears to be a lure. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is part of a link farm hosted on disposable domains, further suggesting malicious intent. No scripts were extracted, but the presence of embedded URLs and the ML classification strongly indicate a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=i+will+make+you+understand+meaning+in+hindi
    • https://cdn.sqhk.co/mimofeto/igdhajg/ordinary_synonyms_and_antonyms.pdf
    • https://nofitipofawotuj.weebly.com/uploads/1/3/4/0/134012335/rujob_mavijumuros_bojav_rebivozelimulin.pdf
    • http://pusulij.22web.org/20934531164.pdf
    • http://sejujanovemo.medianewsonline.com/light_reflection_and_refraction_class_10_sample_papers.pdf
    • http://russianstravel.ru/how_to_start_a_creative_writing_group7m7du.pdf
    • https://cdn.sqhk.co/ranemagesoga/hjid9gi/zepenavibazaguviratusigof.pdf
    • http://momentikshop.space/how_to_apply_window_decals_for_carszvt9z.pdf
    • https://cdn.sqhk.co/baxotonad/ejjlJhe/mijafaper.pdf
    • https://fanamavikere.weebly.com/uploads/1/3/4/6/134610997/powazopifumada-lukojuxaboken.pdf
    • http://biomanua.website/64260988374k0bh.pdf
    • https://sarogixi.weebly.com/uploads/1/3/0/8/130813770/forebemu.pdf
    • https://cdn.sqhk.co/navimoxa/iigddhe/77937908838.pdf
    • http://punejew.mygamesonline.org/list_of_common_countable_nouns.pdf
    • http://20970907.net/43215392854zc6id.pdf
    • https://tifevijokob.weebly.com/uploads/1/3/5/3/135351552/zopilefadive_mirapojesopole.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://didefiwofiko.rf.gd/fojofe.pdf
    • https://uploads.strikinglycdn.com/files/f9d39b36-5f8a-47a0-9628-2be80a9f7012/how_to_price_a_design_build_project.pdf
    • http://nomulumipal.rf.gd/lalinefotoripe.pdf
    • https://uploads.strikinglycdn.com/files/b678bbc8-a001-49ac-b5ca-6efc99ed9202/widefipijutop.pdf
    • http://sebenakerutat.epizy.com/nupafemexugepubevazegu.pdf
    • http://bezopebadutaz.rf.gd/98389940140.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012652.bin
db47917ec892a6dc2056febdd480715d11f4692f53328fed6ed7ed8d82888028		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12652 5316 bytes
font_01_sfnt_off0001383f.bin
07d91ae7abbd70134e1f8d6061121398998da7635c805a3c2aed8846074a5d31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1383F 11412 bytes
font_02_sfnt_off00015ecb.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15ECB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.