Malicious PDF — malware analysis report

Static analysis result for SHA-256 f62962728892a391…

MALICIOUS

PDF

76.0 KB Created: 2021-03-05 11:10:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c5a125e25ce1c03520ef68d63775257 SHA-1: 1141daebdf03ad39f17b6c4c03a3459bd9faa1b2 SHA-256: f62962728892a3914a0ff8cdb6213452a900dbf738d88ec5ac4c253cc2c60920
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, with one pointing to a suspicious domain 'botokaw.ru', suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the presence of numerous external links, including one identified as a potential link farm, strongly suggest it's designed to redirect users to malicious content or download further stages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=ariens+7524+snowblower+for+sale
    • https://cdn-cms.f-static.net/uploads/4371010/normal_603050d87e213.pdf
    • https://static.s123-cdn-static.com/uploads/4380393/normal_5fd063308a5d6.pdf
    • https://static.s123-cdn-static.com/uploads/4470040/normal_600409d2c7ec5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/woxewiwupir/jebapofike.pdf
    • https://s3.amazonaws.com/voropa/69879921933.pdf
    • https://ebbb41b5-b8b7-4bfc-9e1b-23e79ad93844.filesusr.com/ugd/5eba67_724661a300744a7bbdbd4c503c37fb75.pdf?index=true
    • https://s3.amazonaws.com/gazivemon/wireframe_mockup_psd_free.pdf
    • https://973697ad-ffa4-4f9d-85cd-0c9d1ea039ee.filesusr.com/ugd/5f5755_52a7746135564f729666dfa42c49aa10.pdf?index=true
    • https://s3.amazonaws.com/rafiralexezol/carmina_burana_partitura_orquestal.pdf
    • https://uploads.strikinglycdn.com/files/393d8934-6776-45e0-a46a-60af07aa5a4a/domiretoj.pdf
    • https://s3.amazonaws.com/rojalexipokadaz/hurting_each_other_sheet_music.pdf
    • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_3d2640b1cd9948e091d9830dc42bd40d.pdf?index=true
    • https://70fbc5f3-53e4-4072-9ff7-a5862d19847b.filesusr.com/ugd/bb3bf9_7ab7bccf81f44cfd82e27a5477a0cebe.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3f6a6ed2-89e6-471c-bf8b-c32d899aed24/how_many_roald_dahl_books_have_been_turned_into_films.pdf
    • https://s3.amazonaws.com/sejakopa/24545960650.pdf
    • https://5d3a357a-25b2-4459-9cd8-210b235f7b36.filesusr.com/ugd/45e30f_b5f4ab194d754f20b91296d0fa9dcaaf.pdf?index=true
    • https://s3.amazonaws.com/bifadiwuwileji/big_fish_and_begonia_free_movie.pdf
    • https://s3.amazonaws.com/kodipopujufipig/81523220472.pdf
    • https://uploads.strikinglycdn.com/files/0d0e67d4-6702-403c-8e88-b7b27f5f381e/how_to_check_serial_number_of_hp_laptop_through_command_prompt.pdf
    • https://05282879-aed3-4f16-ac14-d534add4d4bd.filesusr.com/ugd/0f8b7c_1d8122b1ec0d4c08888ab19a8e93b7a9.pdf?index=true
    • https://s3.amazonaws.com/bagisi/standard_deviation_excel_worksheet.pdf
    • https://03dfb0eb-7fe6-4188-ad87-ea2b88df7b19.filesusr.com/ugd/f967ac_561e03b5b5c344fcbce280f0ea39b55e.pdf?index=true
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_ec61052ab2df467e816a775e84183e62.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea73.bin
d50ae8f6f55ad71eef43b0364c29c5f8426ba333142b6949af1765dc32b5a314		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA73 5404 bytes
font_01_sfnt_off0000fd0d.bin
1a55cc3f6acd85ccee210e4261e8794a2ce099fea79fa8408eae9655d4f73b1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0D 10904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.