PDF malware analysis — malicious · c5cf8855643b21fc

MALICIOUS

PDF

114.6 KB Created: 2021-03-26 10:39:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07

MD5: 7dea1f9d708af0cebc6303f324c3300a SHA-1: 17c230ee25ed821ed9110b930d76493dff34171f SHA-256: c5cf8855643b21fc3a6a5675842cd0d51c2233237712463b8eb2a06442a67410

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with a primary focus on 'https://botokaw.ru/wix?keyword=cells+organelles+worksheet+answers'. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for numerous links, suggesting a phishing or spam campaign. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/wix?keyword=cells+organelles+worksheet+answers PDF link annotation
- https://cdn-cms.f-static.net/uploads/4428083/normal_60285f2f9b75b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461523/normal_6012d4c52d6d4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407303/normal_60202fd04f1cb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480142/normal_6056695088a34.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426415/normal_5ffacf45b8c38.pdfIn PDF document text
- http://nikaold.site/my_many_colored_days_board_book93z4t.pdfIn PDF document text
- http://slampochka.ru/witakox0cho.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387711/normal_5fcbb8936eb64.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421478/normal_5fdb29fd2e802.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418567/normal_600a515655e52.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/e2bdd5c0-0e31-43ff-a00a-aa512522ce22/14725353757.pdfIn PDF document text
- https://5e024257-ca51-40df-b6b5-a3104c7b7124.filesusr.com/ugd/97368a_c4e1f418b54f45078d87b0d2253b0c7b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/460d385c-5dbe-4113-a917-913b588ac043/introduction_to_computer_system_architecture_ppt.pdfIn PDF document text
- https://d2d87fd5-5f4d-49aa-ab3c-2263ce4b5d22.filesusr.com/ugd/9169d2_66f1cbfda5d2455eaa656e9ed8c5ed8c.pdf?index=trueIn PDF document text
- https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_12900a5639e94360932921b14f64fe7f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xeponodij/acronis_iso_2017.pdfIn PDF document text
- https://s3.amazonaws.com/vizegemawokaxe/865207191.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e334ab8b-e0b4-4956-8e3e-ddc26b63ab6f/wuzokewamikiworuxeze.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5ea4d66-506a-43dc-9182-1c6a7c50e2e3/intex_sand_filter_timer_settings.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00016f09.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16F09	2828 bytes
SHA-256: `a17885b4fd577e0298a64705d5055d2ac7c2363fd7008e9cf236b3df412a17d8`
`font_01_sfnt_off00017903.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17903	4864 bytes
SHA-256: `52cc0d3145261ef9c162a4fa602613c40c3cc4ef49a4913cbfc58df6ee3a0e03`
`font_02_sfnt_off00018995.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x18995	10212 bytes
SHA-256: `047bb08e0da2f383207d5554c276eda3bfbba2ed47bedb199064dfe5e99af875`
`font_03_sfnt_off0001ac42.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1AC42	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.