Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc52864504e040d4…

MALICIOUS

PDF

81.2 KB Created: 2021-03-08 21:53:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4eb9c4fdd2f2d683885f2cd06ff26139 SHA-1: 4e7a771e92fa9125020e5339d6340cbf75897243 SHA-256: fc52864504e040d465186b9263dcb75ea9c129c9dd61b50abb7bdd7e61a220c9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, with 'https://botokaw.ru/aws?utm_term=how+many+beets+per+pound' and 'http://nuzikenevizut.onlinewebshop.net/15029062878.pdf' being prominent examples. These links likely lead to phishing sites or other malicious content, aligning with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=how+many+beets+per+pound
    • https://mibudixu.weebly.com/uploads/1/3/4/4/134490534/voninapobal.pdf
    • https://raxagipob.weebly.com/uploads/1/3/4/8/134883443/a93dd4ab890.pdf
    • http://gosoxegekiri.mywebcommunity.org/pirogafa.pdf
    • https://woziwapimarezex.weebly.com/uploads/1/3/5/4/135400795/c1f8f.pdf
    • https://dukidisivaturan.weebly.com/uploads/1/3/5/3/135311912/9697514.pdf
    • http://momarivido.mypressonline.com/piriformis_syndrome_stretches_and_exercises.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nuzikenevizut.onlinewebshop.net/15029062878.pdf
    • https://s3.amazonaws.com/gezetega/surenebima.pdf
    • https://s3.amazonaws.com/ximupuv/why_is_my_bissell_vacuum_not_turning_on.pdf
    • https://s3.amazonaws.com/getizar/android_tv_sony_bravia_forum.pdf
    • https://s3.amazonaws.com/pesetufavo/what_is_modernist.pdf
    • https://86a9da1b-0b57-4b35-a77a-523886b904cd.filesusr.com/ugd/0d9a50_a390a9e95d8149ad9747786ecbd76d28.pdf?index=true
    • https://s3.amazonaws.com/luramamelolem/vietnamese_tv_guide.pdf
    • http://rogomore.myartsonline.com/kukima.pdf
    • https://s3.amazonaws.com/palevijuj/34045225879.pdf
    • https://s3.amazonaws.com/serogajugomiji/41693153954.pdf
    • https://s3.amazonaws.com/mibiwivanetuj/4027854695.pdf
    • https://s3.amazonaws.com/turip/request_for_british_passport_application_form.pdf
    • https://s3.amazonaws.com/punurum/53830531315.pdf
    • https://bb74f61c-7045-47bf-9a7e-968101ee373e.filesusr.com/ugd/81ef4b_88940375968040c8a172766b52b3182f.pdf?index=true
    • https://ecab545c-19d2-4654-b6ac-fb8b9749f5ba.filesusr.com/ugd/e5412a_3e27d2190ecc498781ca45c6a3df571b.pdf?index=true
    • https://s3.amazonaws.com/juzowilipi/articulate_storyline_360_full.pdf
    • http://pedirite.onlinewebshop.net/46086425003.pdf
    • https://48cc712b-de5e-493e-a198-f8962849e22b.filesusr.com/ugd/d2751c_f65895680c124f59820430efc1aab760.pdf?index=true
    • https://s3.amazonaws.com/wolina/terminabsage_englisch_formulieren.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010072.bin
1dabe2ac05f3fe1075ecf61169d0faa49d2320ed36cad9719de4133d303facfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10072 5368 bytes
font_01_sfnt_off000112a6.bin
24911f0e5e498408ed14bf4b1235f2fcd472b4420393f37bb6df8cca1e54552c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112A6 11028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.