Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc4c73d09ee28279…

MALICIOUS

PDF

75.3 KB Created: 2021-03-19 21:27:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c94ae1142a37e8feffb6bbb5772c9ab9 SHA-1: dfaa5ed8a2f9357f8525ce2845202911841033b1 SHA-256: cc4c73d09ee282792391c9bea9a2ed9a073ea5081bfdbe49fe4e10c244e92344
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as a phishing trojan and ML classifiers indicated a high probability of maliciousness. The heuristic 'PDF_SEO_LINK_FARM' indicates the document contains a large number of external links, with the primary malicious URL being https://botokaw.ru/strik. This suggests the document is designed to redirect users to potentially harmful websites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=shadowland+alyson+noel+pdf
    • http://zotoxilob.getenjoyment.net/debukonanasobi.pdf
    • http://xevamoz.mygamesonline.org/patterns_of_enterprise_application_architecture_free_download.pdf
    • https://rejasujewefem.weebly.com/uploads/1/3/0/7/130738882/3926633.pdf
    • https://taxesewisozigif.weebly.com/uploads/1/3/5/3/135394589/matatinimalisol.pdf
    • https://zomereke.weebly.com/uploads/1/3/5/3/135397468/6030699.pdf
    • https://vutepunuvo.weebly.com/uploads/1/3/1/6/131637517/582f556c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4a5bfc55-71df-4474-8f3e-9f6aca65c64b.filesusr.com/ugd/29b6ce_9bc1554a6c734473add3ee2eb16010d2.pdf?index=true
    • https://a1104102-e7f7-498f-9db5-fd16eb5a1c84.filesusr.com/ugd/3f19aa_687c94e142eb4344957223aa2412932e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4869660c-1550-4647-8138-eee64bfc5541/22610154353.pdf
    • http://ritumogadoj.onlinewebshop.net/zuvapaku.pdf
    • http://mawokale.myartsonline.com/wordly_wise_3000_book_6_lesson_17.pdf
    • https://uploads.strikinglycdn.com/files/8f724889-581a-46c4-a15d-dd0db78316f8/1890970142.pdf
    • https://uploads.strikinglycdn.com/files/080559bd-c83f-49e2-8c3d-a5b72f788215/graco_my_size_65_rear_facing_height_limit.pdf
    • https://uploads.strikinglycdn.com/files/8d01b7e3-9b8d-46ce-a392-bb3fd7879f37/ruzepip.pdf
    • https://s3.amazonaws.com/punurum/naina_lagiya_barisha_song_video.pdf
    • https://uploads.strikinglycdn.com/files/33fd5d37-6da8-4fb2-baf5-6f22bbb8dad7/how_to_find_base_of_trapezoidal_prism.pdf
    • https://uploads.strikinglycdn.com/files/dc21ad80-68d2-4fdc-9ef0-d57be4762465/how_much_does_it_cost_to_replace_septic_tank_and_leach_field.pdf
    • https://uploads.strikinglycdn.com/files/6b64cb1a-1509-4983-82b0-c817c64a030c/ludafodevudakumida.pdf
    • https://s3.amazonaws.com/zabejuvijolu/69122756520.pdf
    • http://bememikat.onlinewebshop.net/free_keto_meal_plan_for_beginners.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb42.bin
bb8063639125ddb6ec928fe4c145d95c4a9a2d8814565fd052b993bbffd64caf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB42 5328 bytes
font_01_sfnt_off0000fd7c.bin
c43d21b5e31af5575f3d1f92e45a74ad4af6d8b75c9b95dd3881a4c51d25c047		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD7C 10180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.