Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7d727a147d4148f…

MALICIOUS

PDF

99.1 KB Created: 2021-03-16 13:33:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f92f8555e98603b7d98d9cf9c9c93e49 SHA-1: 2166aea5c52a435098c0a4a403a51b57111de747 SHA-256: c7d727a147d4148fb4e3003dabb30b2213dcbd7186e509d7a6920383271e56fd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO link farms and phishing. The primary URL, https://botokaw.ru/award?keyword=present+simple+vs+present+continuous+exercises+pdf+upper+intermediate, suggests a lure to a malicious site disguised as a search result. ClamAV detection and ML classification strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=present+simple+vs+present+continuous+exercises+pdf+upper+intermediate
    • http://remawunusubo.22web.org/filson_hat_size_guide.pdf
    • https://xozilozevaloda.weebly.com/uploads/1/3/5/3/135391373/jokeluketem.pdf
    • https://budovabi.weebly.com/uploads/1/3/4/5/134510119/5121158e1548e.pdf
    • https://sibozigoguxo.weebly.com/uploads/1/3/0/9/130969143/1462019.pdf
    • https://romidemifavev.weebly.com/uploads/1/3/1/8/131857114/7d699b8e0.pdf
    • https://muwikilakejo.weebly.com/uploads/1/3/4/5/134519857/tatiledekujoj.pdf
    • http://vabebimubu.iblogger.org/rak_nie_jest_chorob_andreas_moritz_chomikuj.pdf
    • https://rigopodi.weebly.com/uploads/1/3/4/3/134307943/3065065.pdf
    • https://xamilugalaw.weebly.com/uploads/1/3/5/3/135325617/1027930.pdf
    • https://bikizulotozenap.weebly.com/uploads/1/3/1/8/131860645/rijaditujiravidolimu.pdf
    • https://jijobowuzum.weebly.com/uploads/1/3/4/5/134590228/talogexole-vozoridi-nojitedosu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9bc5ff22-e506-45c4-b95f-964b24e21e38/how_to_unclog_hamilton_beach_coffee_maker.pdf
    • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_17a068e7d4c54232a30a694765f66695.pdf?index=true
    • https://47a25507-5c4f-4e73-9b7c-0c49514c8174.filesusr.com/ugd/e00bd3_3d59d7bbdc7d4cf7936932fd47049a81.pdf?index=true
    • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_27ce2dee9a454d2ab6f21a554674552f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/74d23d25-21ac-4306-aca6-9a7df1c4eeee/escriba_una_definicin_propia_del_aprendizaje_basado_en_proyectos_abc.pdf
    • https://107a3552-ed21-4f5d-95e3-510b6eae4444.filesusr.com/ugd/21bbef_42d0367c7040437a82a2dcb37a2fbb27.pdf?index=true
    • https://67a4337f-2b79-4d04-9c1d-2578c80f4945.filesusr.com/ugd/964009_c840c0aac699413094acb63aac088ba4.pdf?index=true
    • https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_9a1572bd0eec440ba49821bcc067acb8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f141fcc9-9526-4301-b3cb-e566ee2bc62a/busubiwud.pdf
    • http://kerurumeninagaw.epizy.com/bill_of_lading_template_doc.pdf
    • https://uploads.strikinglycdn.com/files/fb3706d0-73c5-4d08-8302-80004d99c0e1/28720772385.pdf
    • https://9d50af6f-dbf7-41ba-b854-83985329a12b.filesusr.com/ugd/33c377_9c2819ef50e3472782cfe627c7934c8c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0e88f964-b5f8-4de1-a4f5-2e5b56d709c7/la_metamorfosis_de_ovidio_libro_10.pdf
    • http://famigobefil.epizy.com/umich_course_guide_eecs.pdf
    • http://zojabavikejowi.rf.gd/13074195365.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000146cf.bin
ea9aba43ce86554e9fb4db95580f5345764c97152d14a45406d528987f30e782		 pdf-font-stream PDF embedded font (sfnt) at offset 0x146CF 5428 bytes
font_01_sfnt_off00015939.bin
d698f65b1c767f500e94a36ce81855d8af0d99ff722256846ab0759a97158fac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15939 11172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.