Malicious PDF — malware analysis report

Static analysis result for SHA-256 243a06229bc3ba49…

MALICIOUS

PDF

73.7 KB Created: 2021-04-25 21:37:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cf36d4ccf41af56cb42bd4256fbdb41c SHA-1: 411b7598116c7d55c3f8c379707028e333959263 SHA-256: 243a06229bc3ba49cc7834a9332ba72bcf5257189e060bf5ab1dce8129d2f896
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious and phishing-related. It contains a large number of external links, suggesting a link farm or redirection mechanism. The embedded URL 'https://jacksth.ru/strik?utm_term=does+walmart+do+vaccines' indicates a potential phishing lure related to vaccine availability.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=does+walmart+do+vaccines
    • https://cdn-cms.f-static.net/uploads/4370540/normal_604d0142a938c.pdf
    • http://dewodalaluw.mygamesonline.org/dodudexusolakosujokoxab.pdf
    • https://cdn-cms.f-static.net/uploads/4416928/normal_606bfa7d3ecda.pdf
    • https://cdn-cms.f-static.net/uploads/4490274/normal_5fdc26944ef4a.pdf
    • http://viniveba.mywebcommunity.org/epson_xp_424_ink_amazon.pdf
    • https://cdn-cms.f-static.net/uploads/4417308/normal_606a620b81bc0.pdf
    • https://cdn-cms.f-static.net/uploads/4483070/normal_6024c3479f647.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fc58696d-5825-45d6-a8cf-b4de88556312/9754903065.pdf
    • https://uploads.strikinglycdn.com/files/ee86ba2d-e721-4622-8867-021338d4a828/canon_mp250_full_driver_download.pdf
    • https://uploads.strikinglycdn.com/files/5d359956-e550-432d-a48a-e0f2925f67c1/how_can_you_tell_if_theres_something_wrong_with_your_kidneys.pdf
    • https://a765b249-d442-4b07-8ea9-8318d996b894.filesusr.com/ugd/902d29_b6024df83e0a437a80046ff7be495c41.pdf?index=true
    • https://68420551-d949-41c4-975b-2ae86aa6d062.filesusr.com/ugd/09c3c7_ebc1c3ef2cc0408bbeab989d50bb27ae.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5f3ad2a4-bc04-43cd-9d76-15b4d8dced33/50704273727.pdf
    • https://1618b3f4-dcc0-4047-a816-eeb1cbe43c51.filesusr.com/ugd/a01749_b8e49c1b40194d60bb652a49f6640a6e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/852aadfc-8af7-4ebb-b06d-8dc9d4b40589/how_to_get_impedance_of_a_transformer.pdf
    • https://uploads.strikinglycdn.com/files/ce2ba3af-e309-4932-9c4e-2134d6a0c015/polar_graph_paper_free_download.pdf
    • http://kepewitibafef.myartsonline.com/sopenulivapomifofi.pdf
    • https://3c1efe6f-6e34-41bb-a2c4-2be85dd3cb33.filesusr.com/ugd/41f880_f44e28654cb24c1e8618c8f363b28d34.pdf?index=true
    • https://uploads.strikinglycdn.com/files/98fb7942-b0b2-4c05-8860-9a175855f4b8/how_to_fix_a_kenmore_700_series_dryer.pdf
    • https://uploads.strikinglycdn.com/files/195e2286-d432-4383-9487-014283afe263/86835932808.pdf
    • https://uploads.strikinglycdn.com/files/3bf94b7d-c912-4833-a8df-ae3c46357935/is_american_assassin_on_netflix_uk_2020.pdf
    • https://uploads.strikinglycdn.com/files/bd778e74-d6ae-49d0-a449-7bf3194b9764/what_are_the_7_stages_of_human_development.pdf
    • https://uploads.strikinglycdn.com/files/24865506-1a86-468e-9f85-46e7ed757bd3/porter_cable_scroll_saw_review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0ad.bin
986a297f37088997cc26ec646d8955d32f4ec42228845e8814c9224ae60902d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0AD 5236 bytes
font_01_sfnt_off0000f27e.bin
0d8787a5bc5e49f0ae4169f8e6506ee1de8493d82b380779ea30b1fab405fdef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF27E 10936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.