Malicious PDF — malware analysis report

Static analysis result for SHA-256 b04e6717ba5cd9ef…

MALICIOUS

PDF

91.7 KB Created: 2021-03-24 00:16:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a0d9ec8c41159a1be794f2ca715522a SHA-1: 9a6a652476c87b64bd64fde89c27fc6e36e4a0b2 SHA-256: b04e6717ba5cd9ef8ed009e329ce43383061783a932982d85d94a577f7db7ce0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, with one prominent example being a link to 'https://s3.amazonaws.com/zidenigad/965187418.pdf'. The embedded URL 'https://botokaw.ru/strik?utm_term=why+does+my+hp+printer+say+in+error+state' further supports the attack pattern of directing users to potentially harmful sites. No scripts were extracted, but the overall structure and URL findings point to a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=why+does+my+hp+printer+say+in+error+state
    • https://cdn.sqhk.co/lafixafif/jejjhdF/html_css_code_playground.pdf
    • http://filanion.online/fuzedakitoctmdi.pdf
    • https://cdn.sqhk.co/rizijuwet/hkhbZjf/itunes_download_64_bit_windows_10_home.pdf
    • https://linekepev.weebly.com/uploads/1/3/4/0/134041162/labegelurak-ponar-sedajalubox-sulamemevoxe.pdf
    • https://cdn.sqhk.co/jopogoxom/hgdhfig/rojigemaso.pdf
    • https://puzagetidorijes.weebly.com/uploads/1/3/4/4/134495880/8c85d9c267de.pdf
    • http://relax35.ru/how_to_improve_your_skills_in_free_firen8th1.pdf
    • https://cdn.sqhk.co/wozovege/gid4hid/get_nail_done_near_me.pdf
    • http://dkblogin-de.com/gatinepakozarewezajuki8cd9o.pdf
    • https://cdn.sqhk.co/xonivozew/BidgeQT/wifexinogelarolub.pdf
    • https://fobopogukigu.weebly.com/uploads/1/3/4/3/134366855/kopuwogux-gowejikulimupog-tamat-xefugedoxavabus.pdf
    • https://cdn.sqhk.co/kuvuzebilet/KjbKagc/heap_push_pop_time_complexity.pdf
    • https://setitafonoje.weebly.com/uploads/1/3/1/8/131856277/75c9ae0769.pdf
    • https://cdn.sqhk.co/muvotugi/jjjdfKu/batozomagavakegenireg.pdf
    • https://cdn.sqhk.co/divojimo/eiaT86X/best_free_vr_games_for_oculus_quest.pdf
    • https://cdn.sqhk.co/rotuzuwibi/gjhOiB2/86828057510.pdf
    • http://webdefilmizle.com/ansys_apdl_tutorialievak.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/zidenigad/965187418.pdf
    • https://f187853a-68e6-4ed6-a420-9593b89d6738.filesusr.com/ugd/27c34a_1a5e93c0a87c47faa40442b23ae2eec7.pdf?index=true
    • https://s3.amazonaws.com/tawosutosuxi/i_m_barbie_girl_song_video.pdf
    • https://s3.amazonaws.com/fedojigudaj/42484145638.pdf
    • https://3d7304b5-8527-495f-b913-615d6f357a43.filesusr.com/ugd/ef7486_9828d052ee654ffbbbcb8349b45b490e.pdf?index=true
    • https://ea7788ad-ef5a-48b5-911d-3ad522045378.filesusr.com/ugd/f3bfbb_29975844c7864042ba773e3f15f2cdca.pdf?index=true
    • https://s3.amazonaws.com/jexijer/51031774242.pdf
    • https://9e084d23-5bbf-42ad-98e9-fa9200f8584e.filesusr.com/ugd/4f663b_fa9c56d9594d497bbca6a283f07001fd.pdf?index=true
    • https://a9864912-ad24-422b-99f3-2d90f7703507.filesusr.com/ugd/d6af85_c6fa06a6a95e47eb8d67e6b30750b802.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011cdb.bin
654d45eb6e66ec3bf985bc5dfaf4dbb5db5f28dab2d1773769c4ba904e73a4b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CDB 5072 bytes
font_01_sfnt_off00012dfa.bin
ab5a8dc977126cf4d76f0a04d89b5acc5b191bb5d0df7f5a2a0aeab6ac2c3679		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DFA 10892 bytes
font_02_sfnt_off000152f4.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152F4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.