Malicious PDF — malware analysis report

Static analysis result for SHA-256 46a6f25b997a11fd…

MALICIOUS

PDF

84.6 KB Created: 2021-02-22 16:54:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: fd28aec3f0011ddaf23fbbbe3bc264f9 SHA-1: a1df5088d7c67322da9e2c73dbff7c76fdf44cbe SHA-256: 46a6f25b997a11fdf59a6bc17992b78faadaaeb340fcaa3f4a8876476df31df5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, many pointing to PDF files hosted on `cdn.sqhk.co` and `jottigo.ru`, suggesting a link farm or SEO poisoning attack. The embedded document body text is largely unreadable, but the presence of the URL `https://jottigo.ru/strik?utm_term=asmaul+husna+adalah+nama-nama+baik` indicates a potential phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=asmaul+husna+adalah+nama-nama+baik PDF link annotation
    • https://cdn.sqhk.co/lexoxuxoluvi/8heifGV/roller_blade_hits_car_door.pdfIn PDF document text
    • https://cdn.sqhk.co/pozedezupase/ibhdK3I/solar_system_planets_and_number_of_moons.pdfIn PDF document text
    • https://cdn.sqhk.co/zibavuna/gfbcjeb/falidewutuv.pdfIn PDF document text
    • https://sejomuxajifaged.weebly.com/uploads/1/3/1/4/131437693/e7c4e8.pdfIn PDF document text
    • https://cdn.sqhk.co/rurokusulos/gjcXPhf/53546885212.pdfIn PDF document text
    • https://cdn.sqhk.co/wugolekufo/hjicibk/koxidajetatobi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jonora/telugu_sambaram_movie_video_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxexi/41912800627.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/alaipayuthey_tamil_song_ringtone.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/kerazisutog.pdfIn PDF document text
    • https://s3.amazonaws.com/setikizo/19095596965.pdfIn PDF document text
    • https://s3.amazonaws.com/wizidimawag/hotel_del_luna_soundtrack_free.pdfIn PDF document text
    • https://s3.amazonaws.com/legapatatezisa/17996229002.pdfIn PDF document text
    • https://s3.amazonaws.com/wenobagupexekap/xered.pdfIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/arangetra_velai_hd_video_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/wewiro/71959211215.pdfIn PDF document text
    • https://s3.amazonaws.com/woxojuxafopuv/50301846041.pdfIn PDF document text
    • https://s3.amazonaws.com/buxoparadazegu/logo_barcelona_dls_18.pdfIn PDF document text
    • https://s3.amazonaws.com/susonanezaj/beowulf_cluster_computing_with_linux.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e103.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE103 3104 bytes
SHA-256: 7935a9011d1ddf925e4c615f0d4c7ebc5c36e944a8283dfae3a9b58fd21d210d
font_01_sfnt_off0000ec14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC14 5192 bytes
SHA-256: 2c7bafae247ada6124d81309535a4795a3c1b9952c7ee8c06bf7dfca88a8892d
font_02_sfnt_off0000fd9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD9A 10348 bytes
SHA-256: 6a59d391ee13ead0507459721ce5de86768da388e36909a1f117b1ac728d2a27
font_03_sfnt_off0001211e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1211E 20768 bytes
SHA-256: 9ad329dff769f88b533bb2526bb90ff7e8ccdadc3aa6315ad15bc06009d35e45

Open this report in the interactive analyzer, or submit your own file for analysis.