Malicious PDF — malware analysis report

Static analysis result for SHA-256 d733ca27f725acbf…

MALICIOUS

PDF

75.4 KB Created: 2021-05-08 06:25:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a89954833c0a80786889f91d0a2c8405 SHA-1: d5fd46137fe622364d77c273aeca2bff6c1d2c21 SHA-256: d733ca27f725acbf12390c2467933b5d4f8f6c410c2335b46ca5a81c0e89e359
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents. One of the primary external URIs is https://botokaw.ru/strik, which is suspicious. The ClamAV detection and ML classifier also indicate maliciousness, with the latter flagging it as Pdf.Phishing.Trojan. The document body is heavily obfuscated, preventing a clear understanding of its direct user-facing content, but the link farm structure strongly suggests a phishing or SEO abuse attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=tree+of+life+crystal+necklace+australia
    • http://mitutepoka.medianewsonline.com/68856682988.pdf
    • http://sosixowadisi.iblogger.org/ayatul_kursi_full_download.pdf
    • http://nedavupagisezim.mygamesonline.org/aprender_a_desenhar_passo_a_passo.pdf
    • http://mazoxobiziwikut.iblogger.org/sponges_cnidarians_and_worms_worksheet_answers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/54cc3469-619e-4004-b3d4-bcb7c3d1f7a6/vibixigufajovujot.pdf
    • https://s3.amazonaws.com/didowugorokirug/68685750872.pdf
    • https://uploads.strikinglycdn.com/files/7045b96e-ed68-4ff0-a27a-f7c89f2502c6/how_to_program_ge_universal_remote_24927.pdf
    • https://uploads.strikinglycdn.com/files/6d7747e6-a55d-487a-bf03-69b8b2bbcff8/nuwubidon.pdf
    • https://f78a7b13-e75c-4ddc-9f3c-03cd83736f6c.filesusr.com/ugd/90c53f_f386f21dadf246d2a97a818ced5fc834.pdf?index=true
    • https://4a39c6c9-989b-4d11-b2d8-cc0becc7f193.filesusr.com/ugd/ef0078_da1a6fb065644abd81fd82db539da1b7.pdf?index=true
    • https://71f68c9c-1037-483c-a0ca-f268b7ddd3c8.filesusr.com/ugd/87fdc7_1c53ea4a335945ffa025d00ab6bd34e1.pdf?index=true
    • http://senegowafev.epizy.com/important_questions_for_class_12_biology_chapter_wise_download.pdf
    • https://aed022ca-8a9d-452d-9022-56a74a585a14.filesusr.com/ugd/4d548e_84aa1d3889034d6a965c5be46c4a9a65.pdf?index=true
    • https://s3.amazonaws.com/safago/science_lab_report_introduction_examples.pdf
    • https://uploads.strikinglycdn.com/files/143a909e-388d-4857-80d0-4fee41c4b1ba/63510818089.pdf
    • https://s3.amazonaws.com/kitakilesa/synaptic_package_manager_kali_linux.pdf
    • https://uploads.strikinglycdn.com/files/d3dbd3af-5235-403a-8eac-9ba6e0d11bc7/1957519738.pdf
    • https://e25b5f36-ee09-4010-8803-019b2853a23b.filesusr.com/ugd/c34eac_9ff08538e2ec46cd860ed31b539da8f5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/284c2cba-aa58-40b2-bd1d-5d083fbcf332/roxojinevuwofisup.pdf
    • https://uploads.strikinglycdn.com/files/40e3829f-48d9-4836-beef-f234fd532ad3/delonghi_magnifica_s_cappuccino_review.pdf
    • https://uploads.strikinglycdn.com/files/7baf9ef5-59d4-417b-9bd5-32db8f924a93/rujukom.pdf
    • http://zapibesug.epizy.com/papinabujibujer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2d2.bin
db67e3675ae3f536a60025be6c707ef43c620946f062b00e235a9bc3350d1992		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2D2 4992 bytes
font_01_sfnt_off0000e3e8.bin
7220405695ce892dde6bfa3931fe012a3478f6a4e4df79e5f32170c451025b5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3E8 11400 bytes
font_02_sfnt_off00010a1c.bin
abfd345a6ea1e62b83e5b81470e97c0bb38d81b9d626d8407e597eb2d2192f0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A1C 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.