Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9f086c870e4aada…

MALICIOUS

PDF

78.6 KB Created: 2021-05-21 11:53:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12764f7ae02eac5268de7438562f4f62 SHA-1: b1e1aaf59863e0471ec36bcbb87d3e6881b8bad0 SHA-256: a9f086c870e4aada054e7fe2ea55852a6c455688d9cb8593759224beed40effb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing or malicious content distribution scheme, indicated by the 'PDF_SEO_LINK_FARM' heuristic which identified a large number of external links. The primary URL, 'https://botokaw.ru/wb?keyword=download%20oracle%20java%208%20ubuntu%2016.04', suggests a lure for software downloads. The ML classifier and ClamAV detection strongly support its malicious nature, likely serving as a dropper or redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wb?keyword=download%20oracle%20java%208%20ubuntu%2016.04
    • https://xunopigiwigon.weebly.com/uploads/1/3/1/6/131636761/xadimifipumibuzun.pdf
    • https://static.s123-cdn-static.com/uploads/4480414/normal_5fcf3ab218057.pdf
    • https://lelunoforonu.weebly.com/uploads/1/3/1/6/131606056/mizibikog-faxinofasojetiw-tinuwewigop-limitubome.pdf
    • https://cdn-cms.f-static.net/uploads/4502245/normal_603b6ed56333b.pdf
    • https://kopojari.weebly.com/uploads/1/3/4/5/134585935/6182004.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sakaburepagase/tibevotubulu.pdf
    • https://uploads.strikinglycdn.com/files/8a006d7c-0fa2-49d0-ae58-493be19029ab/61936342420.pdf
    • https://s3.amazonaws.com/wolawatin/ropowenejobasewugilawal.pdf
    • https://uploads.strikinglycdn.com/files/7c2ff811-4ccd-4a5c-b0d8-e37cc7f18ce7/machine_learning_from_scratch_python_book.pdf
    • https://uploads.strikinglycdn.com/files/48da71c4-74a9-4e6d-963e-2f2b7b0229da/allah_mempunyai_99_asmaul_husna_yang_artinya_nama-nama_allah_yang.pdf
    • https://uploads.strikinglycdn.com/files/69ff70a6-9814-4d57-9b63-b2634ab88a2d/69293695025.pdf
    • https://uploads.strikinglycdn.com/files/eba29c1f-4881-4927-8ba9-63cb9534898b/64915942026.pdf
    • https://s3.amazonaws.com/bitajemisajoz/viwerukolapo.pdf
    • https://uploads.strikinglycdn.com/files/067daef2-5ef4-4749-8cb3-8abfc24370ae/phim_binh_php_tn_t_tp_27.pdf
    • https://uploads.strikinglycdn.com/files/df026d66-0dd5-4d0f-a1f7-02dfc95f7823/how_to_use_a_ti-84_plus_c_silver_edition_calculator.pdf
    • https://s3.amazonaws.com/xojafemori/jitekijaxim.pdf
    • https://s3.amazonaws.com/jusuberu/luxotavalapogov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e801.bin
fd2693433f06f69a4f2bef9b6d33e64e6173b746533fbf6f5703c2f2d0f693a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE801 5784 bytes
font_01_sfnt_off0000fbf2.bin
eb01669e4f83f267627e991ea1f95a539ea3798f682140feee1a371df6778a28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBF2 21128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.