Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e98f77e54ebb494…

MALICIOUS

PDF

68.3 KB Created: 2021-04-01 10:59:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 5c2c6e2ea5bfa306dec77ab2dbc82196 SHA-1: 7f6b872af4707e7cb6cf1771b464b038643e797a SHA-256: 5e98f77e54ebb4949ca50f495ccdd6047d8aff92d6bc8a0adecd143d651b06ac
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external links, with a primary link to 'https://jacksth.ru/wix?keyword=writing+skeleton+chemical+equations+worksheet', suggesting a lure to a malicious website. The PDF also exhibits characteristics of a link farm, with many embedded URLs pointing to S3 buckets and other domains, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=writing+skeleton+chemical+equations+worksheet PDF link annotation
    • https://xefujalebide.weebly.com/uploads/1/3/2/6/132681694/4342768.pdfIn PDF document text
    • http://xipodijajul.sportsontheweb.net/jekagisizujot.pdfIn PDF document text
    • https://kamenibez.weebly.com/uploads/1/3/4/7/134727972/zuroro-bezivikit-xoxir-nadelimasex.pdfIn PDF document text
    • https://zepitobazelaki.weebly.com/uploads/1/3/4/6/134619491/3398437.pdfIn PDF document text
    • https://tozubovudifudi.weebly.com/uploads/1/3/5/9/135973827/mubizulebokitolid.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484355/normal_600533d9cb3a7.pdfIn PDF document text
    • http://xadexawufomovi.sportsontheweb.net/bifujaduliwusosas.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412394/normal_60081719396d3.pdfIn PDF document text
    • http://milesatel.mygamesonline.org/blood_bowl_2_best_skills_catcher.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/memobofilenabon/insect_identification_guide_book.pdfIn PDF document text
    • http://jatoxat.atwebpages.com/irregular_present_tense_spanish_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/libusamagowuvo/kindle_paperwhite_supported_formats.pdfIn PDF document text
    • https://s3.amazonaws.com/rovikibixu/95927869184.pdfIn PDF document text
    • https://s3.amazonaws.com/ninazarila/monthly_household_budget_spreadsheet.pdfIn PDF document text
    • https://s3.amazonaws.com/resixexi/18762017274.pdfIn PDF document text
    • https://s3.amazonaws.com/xunilukegez/the_challenge_inferno_3_youtube.pdfIn PDF document text
    • https://a95edb9d-21e5-46e4-bb1b-b1fdf66a5dae.filesusr.com/ugd/09e34a_9d0fb9f3f1814d0dba6aeffed252fda7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rimepusox/drumming_song_sheet_music.pdfIn PDF document text
    • https://83d12552-0bc1-4415-b221-1da25caacb9b.filesusr.com/ugd/1e11d0_323a61896d1945ee9db5ec16f6385a3b.pdf?index=trueIn PDF document text
    • https://6776ac3f-883f-499f-bc52-38dff818ec46.filesusr.com/ugd/969751_0dc69832a502470baebe0dc0563215d5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/baposivarabuj/lusope.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cea6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCEA6 5508 bytes
SHA-256: 28e78fc0b4cf24dd29d922731bf21b49c7df26e511bec7eeee639b98c9465598
font_01_sfnt_off0000e157.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE157 9972 bytes
SHA-256: aa93146d8f5ded792f111216e7ddee0fdc28b4361549e01b7c92b322c97985ef

Open this report in the interactive analyzer, or submit your own file for analysis.