Malicious PDF — malware analysis report

Static analysis result for SHA-256 c72237cd731f4fea…

MALICIOUS

PDF

78.6 KB Created: 2021-06-06 08:26:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 7f42ec91696ef52e70ea7d3a158f1df2 SHA-1: 05a7e16e5aa00816c906df34b893b257f22403ad SHA-256: c72237cd731f4fea8fcaa5e9ec844330d0fc78886e5303afe180d10b1168f4c9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a significant heuristic identifying it as a link farm on disposable hosting. The primary malicious URL, 'https://botokaw.ru/123?utm_term=live+talk+video+call+apps', suggests a lure related to live video call applications. ClamAV detection and ML classification strongly indicate malicious intent, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=live+talk+video+call+apps PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4421040/normal_606c89bc8f024.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424935/normal_5fd1290dcee9b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://posonuxe.pbworks.com/f/39220561073.pdfIn PDF document text
    • http://sisagexal.pbworks.com/w/file/fetch/144621390/83879819356.pdfIn PDF document text
    • http://lewiwebula.pbworks.com/f/bowetewerar.pdfIn PDF document text
    • http://juvudibip.pbworks.com/w/file/fetch/144582927/how_to_make_a_simple_application.pdfIn PDF document text
    • http://vowujepojez.pbworks.com/f/what_are_the_classification_of_bakery_products.pdfIn PDF document text
    • http://kelivesas.pbworks.com/w/file/fetch/144474870/77772724439.pdfIn PDF document text
    • http://bawamotijeku.pbworks.com/f/adjectifs_epithete_et_attribut_exercices.pdfIn PDF document text
    • http://komogabovuwa.pbworks.com/w/file/fetch/144587232/touchstone_3_student_book_answer_key_unit_6.pdfIn PDF document text
    • http://niwomif.pbworks.com/w/file/fetch/144427812/butonapujanixizunidogo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de484989-f411-47c1-8e63-fc8d0b294177/the_weeknd_beauty_behind_the_madness_tour_dates.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6dd74e1-2aa8-4c96-a6b5-57d1d3ac8bf8/87457176445.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c125cd58-f271-4b07-8ff6-f8f4b2d250a0/signos_de_trombosis_en_pierna.pdfIn PDF document text
    • http://xoxafepapesu.pbworks.com/f/69875352649.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/314110e7-d933-4f99-ada6-11c906221636/84604158287.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0405188e-1ece-4479-a4ec-e1954696f370/what_bullets_does_ruger_lc9_use.pdfIn PDF document text
    • http://xifatarege.pbworks.com/w/file/fetch/144550140/douchebag_workout_2_cheat_codes_lists.pdfIn PDF document text
    • http://sufizilofab.pbworks.com/w/file/fetch/144503100/australian_army_cadet_lesson_plan_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f70c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF70C 5036 bytes
SHA-256: b49fa537caf8b62edc105cbe85e0ff89b3ae5bba0a6be71b4fda5fbd762443e8
font_01_sfnt_off0001084d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1084D 10528 bytes
SHA-256: 9de1fc70eb964ef98a46528f7b69cb45155a859b4b9aa26f56fd496cc3076017

Open this report in the interactive analyzer, or submit your own file for analysis.