Malicious PDF — malware analysis report

Static analysis result for SHA-256 bea7360ef9ad55c5…

MALICIOUS

PDF

84.1 KB Created: 2021-03-18 16:08:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 304a2ab9038cc693795beb93e5d6d7f0 SHA-1: 76a00e398062483c9e35e2d1996daebd3524f8c4 SHA-256: bea7360ef9ad55c54b53c87a85bc75ed2ad6bc9093ab64ed0dbdbb3b0b94755b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO link farms and phishing. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, with one pointing to a suspicious domain 'botokaw.ru'. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=female+sex+offender+assessment+tools
    • https://kiruxujekan.weebly.com/uploads/1/3/2/7/132740547/3865708.pdf
    • http://avit0.cc/alan_watts_become_what_you_are3z8ar.pdf
    • http://civiliscmq.online/nebomamoyo4.pdf
    • http://koteyarn.moscow/textbook_probability_and_statisticsj2o7e.pdf
    • http://mapotilij.mygamesonline.org/39634603759.pdf
    • https://damemerivojed.weebly.com/uploads/1/3/4/3/134378109/latutevubufegi.pdf
    • http://blancer.xyz/66874866860mjl9d.pdf
    • http://ig-support-service.com/suzawot4jq15.pdf
    • http://evilcheats.fun/smartez_pump_patient_guideyxa1n.pdf
    • http://lasiwefomibew.sportsontheweb.net/luput.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b89c0965-50b5-483f-b67e-52f573158f4f.filesusr.com/ugd/1e222e_30b28808f0f9487eb615011a73032167.pdf?index=true
    • https://4cd5a77a-be8d-44ba-8952-4177873115c4.filesusr.com/ugd/930050_3f313926752f47e0b25ec8d334a41d2d.pdf?index=true
    • https://2559d30b-64cd-4b4d-aaad-e76a675dde99.filesusr.com/ugd/f5a024_fb2986131ecd4c50bd613a67f5b3c390.pdf?index=true
    • https://6e8b94c7-278c-4a65-9c30-8d61c93a8f31.filesusr.com/ugd/9ff9b8_7db851b3fcd34006a6d320cec0ef4aec.pdf?index=true
    • https://4b5f4e46-8b81-4257-bf39-61fc08ba57b0.filesusr.com/ugd/7ea8bb_246ed78ae65448bd8e6ca1dff92c9a04.pdf?index=true
    • https://5a060084-92f5-4e09-b02e-bbac8bb45871.filesusr.com/ugd/05c943_b2f4f84938f24bb29dd736f53741e751.pdf?index=true
    • https://200ee3fc-349d-4871-b5c3-2c1c69b60476.filesusr.com/ugd/7b00a0_07da02b1e0bb4278acafd1bf76a8b5f4.pdf?index=true
    • https://86a9da1b-0b57-4b35-a77a-523886b904cd.filesusr.com/ugd/0d9a50_439ad5f3db5049e79f20df74a4d90c1b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b87.bin
5e2c25806f4ece17f76c38ad2715a5a4fd7cfc7ed331c01f51b0200b7c2dee17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B87 5076 bytes
font_01_sfnt_off00011cb4.bin
071a3a522e9aa0b3513e9cce354ba716b6f6740720002c88a499e75ff737861f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB4 11392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.