Malicious PDF — malware analysis report

Static analysis result for SHA-256 28b29b526659f44b…

MALICIOUS

PDF

76.6 KB Created: 2021-03-13 23:46:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ed2b6cc7b9f5e706f354bad490cae80f SHA-1: bf3d4d890e1d0a840b04a2ef349955b522c40055 SHA-256: 28b29b526659f44ba4f13321548adab6bf26c20a54f9fa99dd7e48f5f5220f79
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking documents, but one link to 'jacksth.ru' is suspicious and likely leads to a malicious site. The ML classifier and ClamAV detections strongly indicate malicious intent, classifying it as a phishing or trojan delivery mechanism. No scripts were extracted, but the PDF structure itself is used to host and distribute links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=do+new+gas+stoves+have+pilot+lights
    • https://rodibafabe.weebly.com/uploads/1/3/0/7/130738722/wegaripilosaravin.pdf
    • https://bexudedumazises.weebly.com/uploads/1/3/1/4/131406785/kerar-rulifil-dugiza-razivudi.pdf
    • https://lotatodekimin.weebly.com/uploads/1/3/4/7/134705716/fomurosixinoja.pdf
    • https://static.s123-cdn-static.com/uploads/4393755/normal_600672002132c.pdf
    • https://gokepitamewema.weebly.com/uploads/1/3/5/3/135325242/7493260.pdf
    • https://cdn-cms.f-static.net/uploads/4473656/normal_5fdc15a731196.pdf
    • https://firikanafumofud.weebly.com/uploads/1/3/0/9/130969048/ferijovupulibuz.pdf
    • https://viwalamul.weebly.com/uploads/1/3/3/9/133997630/magajaf-siwusogikafi-gipalalo.pdf
    • https://cdn-cms.f-static.net/uploads/4391649/normal_601cce574d6be.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/diwitapezu/german_shepherd_puppy_food_chart.pdf
    • https://uploads.strikinglycdn.com/files/01259125-88d0-4916-b3d5-c54efab132c1/fasidibidudago.pdf
    • https://s3.amazonaws.com/xeropizuwe/subject_and_verb_agreement_quiz.pdf
    • https://uploads.strikinglycdn.com/files/3d646b99-885c-4b4a-9b1d-b6697fc003e2/que_es_una_organizacion_empresarial.pdf
    • https://s3.amazonaws.com/rubidokezive/62260423792.pdf
    • https://uploads.strikinglycdn.com/files/69de3779-1b1b-4db4-93eb-b2ffda7af624/calories_arbys_roast_beef_slider.pdf
    • https://s3.amazonaws.com/jeworurowam/vonajavepogeju.pdf
    • https://uploads.strikinglycdn.com/files/2e2552e6-2e0a-42a1-a5f1-e5ceebb58bf8/luxury_hotels_washington_dc_near_white_house.pdf
    • https://s3.amazonaws.com/fujadabez/glencoe_mcgraw-_hill_oklahoma_algebra_1_answers.pdf
    • https://s3.amazonaws.com/jutenojamega/how_to_replace_drive_belt_on_husqvarna_riding_mower_yth2348.pdf
    • https://s3.amazonaws.com/remeranexe/muzijujapozeligudalenunoj.pdf
    • https://s3.amazonaws.com/desenaz/potbelly_sandwich_shop_menu.pdf
    • https://uploads.strikinglycdn.com/files/1805baea-f77b-48ef-918c-94491d05da8a/diary_of_a_wimpy_kid_double_down_download_kupdf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee45.bin
7276e39fb1c5969e37dbc7a5a0a6e839a67d6aa0a55d0878656b1b27314fdb95		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE45 5136 bytes
font_01_sfnt_off0000ffe5.bin
940845b195be860de8c6bb5c009fee3ac70adfbe9274c0e92ad93619e88a86e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE5 11104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.