Malicious PDF — malware analysis report

Static analysis result for SHA-256 c21c6260f59b0c95…

MALICIOUS

PDF

77.5 KB Created: 2021-04-07 04:18:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: d11af5aae97633bd76f8398c3762bbf3 SHA-1: f73fb882a779887163e45c8beb98a8ec2b0d1dc5 SHA-256: c21c6260f59b0c95ba971d07218bb5f994c7f9b2c411e35a08adce2cfa2be91f
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with a primary suspicious URL pointing to 'botokaw.ru', suggesting it's used for phishing or malware distribution. The document body, though heavily obfuscated, contains metadata related to wkhtmltopdf and a date, but no clear textual lure is discernible. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8909

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=chicken+chaap+recipe+in+bengali+language+pdf PDF link annotation
    • https://dufadijikog.weebly.com/uploads/1/3/5/3/135325035/3133215.pdfIn PDF document text
    • http://womenit.space/positive_and_negative_effects_of_globalization_in_the_philippinesencc6.pdfIn PDF document text
    • http://taher-tcac.com/25971461815en5s3.pdfIn PDF document text
    • http://instapodarok365.site/how_to_solve_cat_questions_quicklykzka6.pdfIn PDF document text
    • http://wumokejo.iblogger.org/design_diaries_creative_process_in_graphic_design_free_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405904/normal_5ffa9d99dad76.pdfIn PDF document text
    • https://tekegalesi.weebly.com/uploads/1/3/0/7/130740489/0538241fd6bac.pdfIn PDF document text
    • http://kersita.fun/xifagelekatunenevir7f3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497372/normal_602105d548a3b.pdfIn PDF document text
    • http://bilkan.fun/car_mechanic_simulator_2020_pc_baixarlozyw.pdfIn PDF document text
    • https://bifitulodagox.weebly.com/uploads/1/3/6/0/136081839/7a9f9cb4b0a.pdfIn PDF document text
    • http://upgrade4me.com/wrong_turn_full_movie_isaiminio16xu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476946/normal_5ffdcdce03fa5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4be50d1a-01e9-41f3-902b-67e26c029055/linksys_ea6500_extender_setup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e25963d3-0151-4127-a8a9-bdd22cc558dd/how_do_you_program_a_philips_3_universal_remote.pdfIn PDF document text
    • http://dozaruzegilesok.epizy.com/walter_cutting_tools_catalogue.pdfIn PDF document text
    • http://zexukojol.rf.gd/gi_joe_movie_parents_guide.pdfIn PDF document text
    • http://vifikuvikepavad.rf.gd/how_to_reset_drum_unit_on_brother_printer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09aaac9b-46de-40e1-9093-761cc03bc5d8/salozukorunoruwanopumuv.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f85a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF85A 5348 bytes
SHA-256: bc112ff808f3bbc5f3d502aea9fe82944c4809d4f3e35311812308fd9732e53e

Open this report in the interactive analyzer, or submit your own file for analysis.