PDF malware analysis — malicious · 3edc50f0e33df361

MALICIOUS

PDF

73.1 KB Created: 2021-02-28 11:19:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 60f652c0800434c3c6fe6424e35351ef SHA-1: 5dac2f885feb4740f0cc888d959b5b4249a7dfd4 SHA-256: 3edc50f0e33df36142641e288c61a347f3651b10007c3185298a6f0cbc25f430

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. It contains a large number of embedded external links, suggesting a link farm or phishing attempt. The primary URL identified is https://jacksth.ru/strik, which is likely part of a campaign to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=why+does+my+dryer+keep+running
- https://cdn.sqhk.co/dutebevon/cifmRjh/limbo_demo_game.pdf
- http://xesubixuj.iblogger.org/zelaxigirigifi.pdf
- https://cdn.sqhk.co/jeposanop/wYij1mv/cooking_grills_at_walmart.pdf
- https://gevivefopunuxaf.weebly.com/uploads/1/3/4/3/134331765/sotopumap.pdf
- http://wigisosidika.22web.org/generac_gp5500_owners_manual_oil_change.pdf
- https://mobuverafawez.weebly.com/uploads/1/3/5/3/135346795/7749210.pdf
- https://pozimifekof.weebly.com/uploads/1/3/4/6/134674510/nutomavit.pdf
- http://ratonawe.iblogger.org/13588277590.pdf
- http://jofarofuwudeveb.66ghz.com/marexex.pdf
- https://wakevilapiz.weebly.com/uploads/1/3/4/9/134903367/3626816.pdf
- https://lugijuvumefabi.weebly.com/uploads/1/3/4/7/134761930/520b15e.pdf
- https://gofupadosu.weebly.com/uploads/1/3/4/8/134853885/duvesobeluziwi.pdf
- https://static.s123-cdn-static.com/uploads/4453142/normal_5fedc23123d66.pdf
- https://cdn.sqhk.co/tuzevawu/chiShW6/cia_world_factbook_gdp_2018.pdf
- https://cdn.sqhk.co/masunidupag/dgdDigq/67311896814.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/satudifin/vufuxopejifatuselarer.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e1d9.bin` `21491de3703d4048251d18af28ec0218fea53065ed359450bc6b20dc11d91c6f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE1D9	5308 bytes
`font_01_sfnt_off0000f3da.bin` `258d812a8412f1019d0e73b55a38c8d6658b7a13c972c292c089e0b1fd95c026`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3DA	10592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.