Malicious PDF — malware analysis report

Static analysis result for SHA-256 a18aff2b53327804…

MALICIOUS

PDF

75.6 KB Created: 2021-05-13 19:13:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 129f54d07c06f73ed76d17c07f436ae9 SHA-1: baab7d6e7ac5e3c774fb42cb9094505e142edfb3 SHA-256: a18aff2b53327804c7a206dae19d66fd01247f5a12a6c43b4493cf1b4ce101ee
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or SEO spam tactic. One of the embedded URLs, https://botokaw.ru/strik?utm_term=how+to+connect+xenyx+1202fx+to+computer, is likely the primary lure. No scripts were extracted, but the PDF structure and numerous external links indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+connect+xenyx+1202fx+to+computer
    • http://wonamesavap.iblogger.org/who_was_the_first_psychiatric_social_worker.pdf
    • https://kamobukumigudeg.weebly.com/uploads/1/3/1/0/131069934/e61bd11392cf2.pdf
    • http://durebemidiges.getenjoyment.net/kogubakixefokafajuxoxadu.pdf
    • http://ramuwesitavoz.mywebcommunity.org/how_to_start_up_a_weil_mclain_boiler.pdf
    • https://xabuwizadapipuw.weebly.com/uploads/1/3/4/3/134351583/4441725.pdf
    • https://zilexewutefak.weebly.com/uploads/1/3/4/6/134608169/lutadafe.pdf
    • http://vasamekekegu.iblogger.org/ivy_global_practice_test_2_answer_explanations.pdf
    • https://fupojipivub.weebly.com/uploads/1/3/4/5/134525069/9672159.pdf
    • http://vorusobowa.66ghz.com/evangelio_apocrifo_de_san_juan.pdf
    • http://boguvijuximu.22web.org/zijuxotipusonujugegisi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/30ad465f-178a-4171-8756-f7d08b88c744/66461384188.pdf
    • http://lotitivixuji.rf.gd/17326729533.pdf
    • https://uploads.strikinglycdn.com/files/5ec0bc48-45af-476e-9392-24391046ddd6/symposium_plato_characters.pdf
    • https://uploads.strikinglycdn.com/files/72485f02-c9a6-4e92-ade3-13f8a54ef63d/forrest_fenn_treasure_found_pictures.pdf
    • https://uploads.strikinglycdn.com/files/fb09a013-a453-41fe-a1e8-26e25aeb5545/gdp_and_per_capita_income_of_nepal.pdf
    • http://bobatinufej.rf.gd/lawomufeze.pdf
    • http://zizenatoxu.myartsonline.com/word_synonyms_and_antonyms_list.pdf
    • http://kaxumepidigiwe.rf.gd/99310476697.pdf
    • http://mafovito.rf.gd/what_ink_does_a_hp_deskjet_2132_use.pdf
    • https://uploads.strikinglycdn.com/files/968ff73f-72e3-4d93-a1bf-04578cf7ecec/pathfinder_2e_advanced_races.pdf
    • https://uploads.strikinglycdn.com/files/c0874ab8-d4e0-49f4-b0cb-4ea351026ef8/17927397188.pdf
    • https://uploads.strikinglycdn.com/files/2fa2c38a-1cca-4be9-81c6-0304591ab7e2/puraritugov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec31.bin
6c485c1475c77309359c1f52f9731363e806216154bbf2cdfa6ee20db4df5aad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC31 5288 bytes
font_01_sfnt_off0000fe47.bin
3e9e3ac6461071e97a5d37de3bf75cdf5abe88f7180256e02e5c7f6c436d7101		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE47 10092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.