Malicious PDF — malware analysis report

Static analysis result for SHA-256 ceb889b56e28eb84…

MALICIOUS

PDF

93.9 KB Created: 2021-03-31 17:05:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a764f646f9d9a508ee48741d81ad2572 SHA-1: 933fb9985d84ee75bdc499e46820a5b91e3461d7 SHA-256: ceb889b56e28eb84b9637a2a684b18fc50ed92866ca1ee0d2aabf6264c2fcfeb
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with one prominent URL pointing to 'botokaw.ru', suggesting a phishing or scam lure. The document body, though heavily obfuscated, contains metadata related to its creation, which does not detract from the malicious indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=fundamental+concepts+of+modern+mathematics
    • https://cdn-cms.f-static.net/uploads/4384483/normal_60600032d5894.pdf
    • https://static.s123-cdn-static.com/uploads/4487623/normal_60035e4d9660a.pdf
    • https://cdn-cms.f-static.net/uploads/4498868/normal_603f228a1ea39.pdf
    • https://cdn.sqhk.co/zaxuloxedu/hggiigd/equalizer_fx_pro_rexdl.pdf
    • https://cdn.sqhk.co/jizapamilizo/yoxheij/powupofiwixewexinoredase.pdf
    • https://cdn-cms.f-static.net/uploads/4443608/normal_5fdba21e87df5.pdf
    • https://cdn.sqhk.co/fujotojaxob/djhpvvv/majumilipesinixapu.pdf
    • http://subbellassecret.com/84015655576kgglt.pdf
    • http://how2clever.com/guviroxemodotosasoxaselizecauw.pdf
    • http://rimka.xyz/pixel_experience_rom_poco_f1_android_10a7fks.pdf
    • http://laulu-go.ru/joyetech_evic_vtc_dual_coilmpepr.pdf
    • http://rezotu.xyz/74842340521zoifr.pdf
    • https://cdn.sqhk.co/nakusunegud/8jvhdQD/kiran_ssc_mathematics_book.pdf
    • https://cdn-cms.f-static.net/uploads/4494436/normal_60484e3521f5e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com/ugd/754d94_477189b3653e4667bb273176e3d494dd.pdf?index=true
    • http://fujurojulode.rf.gd/lilemowipudiguwobodeluxej.pdf
    • http://madijobap.epizy.com/mibipalegolebuxarugoral.pdf
    • https://9e9203d9-9f5b-42f2-a849-05e42d741f90.filesusr.com/ugd/3527d5_d9892aec19a74fa3b27dc2d70e301b3e.pdf?index=true
    • http://xanivuva.epizy.com/medodafetabu.pdf
    • http://difiwawi.epizy.com/77669107341.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000130df.bin
e156da78842c93a10d2c1c454982eeb7c3575ad838bc4f3c9ac45fa661fbf28f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130DF 5352 bytes
font_01_sfnt_off000142e7.bin
d9453cf174c7d3419efac5ef1e5238b7b87b499d0ef90167e4fa9d861fea6721		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142E7 11572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.