PDF malware analysis — malicious · aee4f99ca2158333

MALICIOUS

PDF

68.1 KB Created: 2021-03-03 04:06:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: 789545e9de2963531bbada763524e575 SHA-1: d22e6008c34aa6f258855bdbfac4f3573340cfa7 SHA-256: aee4f99ca21583333679d1546bde85778c6676685d5a8f03a1c8c0b6b58c2270

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with a primary one pointing to a suspicious domain ('botokaw.ru') that is likely used for phishing or distributing further malware. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed to host numerous links on disposable domains, further supporting a malicious intent. The ML classifier and ClamAV detection strongly indicate malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9857

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/award?keyword=why+don%2527t+students+like+school+audiobook PDF link annotation
- https://cdn-cms.f-static.net/uploads/4405206/normal_6019165d3c5b2.pdfIn PDF document text
- http://noverst.xyz/snowden_cast_membersgj0xq.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366407/normal_60173fb9a99ed.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422161/normal_602474e247e9b.pdfIn PDF document text
- http://kifipawatixitaj.iblogger.org/hp_elitebook_folio_9470m_i7_price_philippines.pdfIn PDF document text
- http://kadaxejob.mypressonline.com/sears_5hp_chipper_shredder_manual.pdfIn PDF document text
- http://korefubelexusiz.medianewsonline.com/skyrim_vortex_load_before_or_after.pdfIn PDF document text
- http://suvuxivenorum.mypressonline.com/what_color_is_dapple.pdfIn PDF document text
- http://strapslap.online/definicion_de_estres_oms4jem8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380691/normal_6032723280f50.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fafegeki.rf.gd/hacking_exposed_1st_edition.pdfIn PDF document text
- https://s3.amazonaws.com/kufazete/misutibukerape.pdfIn PDF document text
- http://zobovobewuw.epizy.com/25177140868.pdfIn PDF document text
- https://s3.amazonaws.com/jamuluvuvava/firedezaduzi.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f098.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF098	5284 bytes
SHA-256: `006b456df59890cee7b955e7046fb6c439a297a965ad5684bb9b2c1ca2615c48`
`font_01_sfnt_off000102a3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x102A3	1800 bytes
SHA-256: `6d2a3a16cc464ce72cf05976c7f96a31c93af2202e0dc760c37a694345e222ee`

Open this report in the interactive analyzer, or submit your own file for analysis.