Malicious PDF — malware analysis report

Static analysis result for SHA-256 1355b0b199136423…

MALICIOUS

PDF

73.6 KB Created: 2021-03-22 09:54:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 645ba190bddb8b7c592e00cb89405a3d SHA-1: 22966c61d835bda206b9b04582e21deada2b6e5c SHA-256: 1355b0b1991364237b4481e4ea0ad377cefedb45a750d454c3a2e188862dbdc8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating it functions as a link farm and contains an external URI. The primary malicious indicator is the redirection to the URL 'https://jottigo.ru/award?keyword=2nd+grade+math+money+worksheets+pdf', suggesting a phishing or malware distribution attempt disguised as educational content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=2nd+grade+math+money+worksheets+pdf PDF link annotation
    • http://tufepuwaw.iblogger.org/54371462419.pdfIn PDF document text
    • http://rojenugilin.22web.org/jofoxifaralemude.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4391326/normal_5fe4c670c70d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393911/normal_60232e0f8349e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415546/normal_6019c468ac809.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462974/normal_604440be710eb.pdfIn PDF document text
    • http://dovejeve.22web.org/baidu_pc_faster_free_filehippo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://acfcda0b-1795-4b40-aedc-9a0bc13047ce.filesusr.com/ugd/89c6ad_45c0b14776fc457fbaaa542ff074abe8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/72659351415.pdfIn PDF document text
    • http://sujetokotew.rf.gd/mamebofesoborifu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/279f0b30-ee47-40ff-b687-47599becada0/kosajigusosim.pdfIn PDF document text
    • https://e26976e3-f089-44cc-a2a6-54bcc6cae308.filesusr.com/ugd/0df15e_6d820a06888a4edc8777f3e477a3c454.pdf?index=trueIn PDF document text
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_6866df5621444597ad02e18783d04884.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa7b760c-8c3e-42a7-8d76-9915cc6ca3c0/makufomut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3a920f5-d445-47b9-a9af-0dd38da03cb5/what_makes_someone_working_class_uk.pdfIn PDF document text
    • https://74bb8966-1fc2-43cb-a641-24c20f380d28.filesusr.com/ugd/84c7b5_eed50a7a5f204a0191c0d613798e4310.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/52e71b4c-2a83-4d90-a3b0-ca62ee4904e9/pizotitegijoraxozolisezix.pdfIn PDF document text
    • https://s3.amazonaws.com/rizezobabub/puvezedarip.pdfIn PDF document text
    • https://s3.amazonaws.com/sazomo/33045310325.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0a0e140-02b0-48ca-8750-153af6cc3506/manager_of_food_service_job_description.pdfIn PDF document text
    • http://zoxumatodemake.rf.gd/lidepugilobumojobelezujo.pdfIn PDF document text
    • https://992bddda-184d-467f-a815-0165b41a2208.filesusr.com/ugd/69695d_f4fc783d5794452f8b73c64a80138c42.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ddb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDB9 5720 bytes
SHA-256: 0bd4ef744fb7360e5e0632df7f795a1aa57c817ae9a5f0ef5692b1c19d903ac6
font_01_sfnt_off0000f127.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF127 11376 bytes
SHA-256: 16f93aa8c4e2f906471cb99ebb345c5eb735790dcea472b8a5c913caa16591c0

Open this report in the interactive analyzer, or submit your own file for analysis.