Malicious PDF — malware analysis report

Static analysis result for SHA-256 18e8c72de5cba1c1…

MALICIOUS

PDF

75.6 KB Created: 2021-05-08 09:50:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1d0dcacec8d3cc7f5fd1df8817936eb6 SHA-1: d231d168b7635979a3d8e7dc073eefc3b6e3326c SHA-256: 18e8c72de5cba1c1c219d258792df62192fdca926d8119e8d99e9e6b7866369d
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs, one of which, https://jacksth.ru/strik, is flagged as suspicious and likely leads to a malicious site. The document body, though heavily obfuscated, appears to reference printer setup information, suggesting a lure to trick users into visiting the malicious URL. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=hp+laserjet+pro+m1217nfw+mfp+wireless+setup
    • https://xubuvene.weebly.com/uploads/1/3/1/3/131380433/928ef6fb6fc.pdf
    • http://lusudebela.iblogger.org/how_to_use_a_master_forge_propane_smoker.pdf
    • https://zokolukesowi.weebly.com/uploads/1/3/0/7/130776120/1bfd847185f.pdf
    • https://wanalupegekiful.weebly.com/uploads/1/3/4/8/134879682/vitixananu.pdf
    • https://pamesatigifimes.weebly.com/uploads/1/3/4/6/134639420/gerekimija_safafu_xoropin_bobadepekudo.pdf
    • https://pegugaxuxidugif.weebly.com/uploads/1/3/1/1/131164321/runizelatutidesabup.pdf
    • https://cdn.sqhk.co/vumuwilaj/dphgFje/ww2_european_theater_quiz.pdf
    • https://cdn.sqhk.co/gupuwiwi/jajjKhe/78961828211.pdf
    • https://cdn.sqhk.co/sabepakofo/ihhXi1Y/21078964363.pdf
    • https://cdn.sqhk.co/murafabu/qYSifXS/zagowexadamatugofav.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f75e0263-f09f-4d61-a367-0753d6e3b7a4/what_channels_is_dish_network_dropping_2021.pdf
    • http://xerezaki.epizy.com/imperative_and_exclamatory_sentences_worksheets.pdf
    • http://sadamenukovizep.epizy.com/braggs_liquid_amino_nutrition_information.pdf
    • https://uploads.strikinglycdn.com/files/6bf14a57-3eaf-47e4-ab03-f84b4feb8795/takesusexezezikozozor.pdf
    • https://s3.amazonaws.com/jozaponi/1678045001.pdf
    • https://s3.amazonaws.com/jupevuxirapi/how_to_adjust_di2_rear_derailleur.pdf
    • https://s3.amazonaws.com/fovezewi/gomuzowexewoxajaso.pdf
    • https://uploads.strikinglycdn.com/files/1e3eac8e-f1ae-4457-b51a-c378a8476c9e/julakod.pdf
    • http://dipibezepipes.rf.gd/wire_gauge_chart.pdf
    • https://s3.amazonaws.com/fekaduvopigab/blocchi_cad_dwg_free.pdf
    • https://s3.amazonaws.com/waxegatulo/how_often_to_change_oil_2015_prius.pdf
    • https://s3.amazonaws.com/jinotugiwomo/bluetooth_module_for_mac.pdf
    • https://uploads.strikinglycdn.com/files/b391327b-e15d-4053-9ada-8dbb3b0a2995/how_to_use_chummie_bedwetting_alarm.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9d6.bin
0adad24cd39ec7c2eac518b2d67fa96e81d21e3e1cb2e3c1981eedd934d73e13		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9D6 5440 bytes
font_01_sfnt_off0000fc62.bin
43b3a0a6b75c2fa724545c7da9ce124a1c496170f85aaae5b52d4044b13507b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC62 10720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.