Malicious PDF — malware analysis report

Static analysis result for SHA-256 18cd406c2ce90ed8…

MALICIOUS

PDF

81.2 KB Created: 2021-03-14 10:45:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 96eee5ac12dc2ba8cee8a035853a76f0 SHA-1: 1c269e3e2a9d89f54f3a0acbffad18ce57f541f3 SHA-256: 18cd406c2ce90ed8f180f2797c66234fb78f19137e89b393b596a4e9c81afa22
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains numerous external URIs, with a primary suspicious URL pointing to 'jacksth.ru'. The document body, though heavily obfuscated, suggests a lure related to 'Star trek discovery season 2 cast and crew', likely to trick users into visiting the malicious site. No scripts were extracted, but the PDF structure and URI findings strongly suggest it's a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=star+trek+discovery+season+2+cast+and+crew PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4390350/normal_5fd200c618513.pdfIn PDF document text
    • https://cdn.sqhk.co/lutuganoda/1jbhj4n/mizem.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384822/normal_602820e66f465.pdfIn PDF document text
    • https://cdn.sqhk.co/waxigapo/jchjmgf/video_player_for_windows.pdfIn PDF document text
    • https://cdn.sqhk.co/jebavimot/cM8rDke/maze_runner_scorch_trials_cast_interview.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455183/normal_5ff9317e4b141.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501645/normal_6044fa69bab36.pdfIn PDF document text
    • https://cdn.sqhk.co/woxekivepi/jggfXjh/pazemegafozurimamoxa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479710/normal_6046d9be784b0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab39441f-6932-4133-bea1-0ca9cbbac7e2/irritrol_rd-600_manual.pdfIn PDF document text
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_d1227612dfe14cc8bb355aa8c5ce01af.pdf?index=trueIn PDF document text
    • http://mekidojakad.rf.gd/68825405611.pdfIn PDF document text
    • https://6ba7316d-b84b-4ccb-a32a-103c856d4013.filesusr.com/ugd/91f37e_ec5de05d2e3f46ceb60d54d18eaf75c3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4650af34-0d5e-4137-a18b-4fd69a8e0ae1/chemistry_chapter_6_test_b_answer_key.pdfIn PDF document text
    • https://4e4301d6-cc9a-4939-960a-6b497c1efea6.filesusr.com/ugd/d78803_9b3f60d49901410591c34e315ea90fff.pdf?index=trueIn PDF document text
    • https://2d130471-2a64-48ba-87cf-8f1e86c6acad.filesusr.com/ugd/9c43ec_890e5ee870344a1da431c88e30848090.pdf?index=trueIn PDF document text
    • https://1b15a19f-c8c2-4d9d-8c2f-e97aa7ecfe2c.filesusr.com/ugd/eb6c48_fb7dbcac8adb48a2b9c9525b73e78adc.pdf?index=trueIn PDF document text
    • http://kegunujav.epizy.com/85810364966.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1cb74b6-3d4d-4fd9-8be5-0e66fbc75723/retezatolamewedutezesifev.pdfIn PDF document text
    • http://maboduxivugiv.rf.gd/assembler_plusieurs_pages_mac.pdfIn PDF document text
    • http://bafimilatape.epizy.com/dodobobi.pdfIn PDF document text
    • https://5e446c31-fcb6-4427-a178-91ee45bbff8b.filesusr.com/ugd/4e76b8_c5684fa7ec9e43ecbc410513455a7ed9.pdf?index=trueIn PDF document text
    • https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_4fd2b83a638f4b0089ac2acb8534225c.pdf?index=trueIn PDF document text
    • https://da99f664-88c7-4a27-98aa-0bbcec2e8f57.filesusr.com/ugd/66f3f9_5f7c342183c14ef69b893009b780ae03.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/36d29102-2ef8-48ca-8900-dcb3e6c36208/kaniw.pdfIn PDF document text
    • https://584abdf6-e408-48d3-a53c-4313a8f82471.filesusr.com/ugd/18ee90_02cdb354188d4200b69e9a1160f5d32b.pdf?index=trueIn PDF document text
    • http://runoxujozu.rf.gd/abdominopelvic_regions_and_quadrants.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF96 5456 bytes
SHA-256: 400e58519c39fb318d43b3c4282464f69aa78719c8c3e819fb188327eaaf50a6
font_01_sfnt_off00011250.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11250 11092 bytes
SHA-256: 42c2805a5e3c7c30d7b6325664afd502ee40833e24050dbba17c2c90df74a5e5

Open this report in the interactive analyzer, or submit your own file for analysis.