Malicious PDF — malware analysis report

Static analysis result for SHA-256 6587a1a158a63335…

MALICIOUS

PDF

104.6 KB Created: 2021-05-02 23:13:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8a5476e0e8c8ee79546aa3cd99a3de8c SHA-1: b64160584101803562367d47b9bee58ae4cc1ce2 SHA-256: 6587a1a158a6333508c6d913142fb25c760a5df85ba45e13addde88d2c70c57d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many pointing to other PDF files, suggesting a link farm or phishing attempt. The primary URL identified is https://jacksth.ru/strik?utm_term=tokyo+ghoul+unravel+english+lyrics+unknown+songbird, which is likely used to redirect the user to a malicious site. No scripts were extracted, but the PDF structure and numerous external links indicate a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=tokyo+ghoul+unravel+english+lyrics+unknown+songbird
    • https://cdn.sqhk.co/venitalobeni/EJ7gejg/97822814632.pdf
    • http://wivaserana.mywebcommunity.org/tukiw.pdf
    • http://nufudoze.getenjoyment.net/cfa_level_3_alternative_investments.pdf
    • https://cdn.sqhk.co/sadirorig/eighc8p/lego_marvel_superheroes_walkthrough_part_4.pdf
    • https://wilaruxade.weebly.com/uploads/1/3/4/8/134865150/jukamifa_nodutubozeburo.pdf
    • https://wirosumarot.weebly.com/uploads/1/3/1/3/131398493/maman_gojaxo_tukujenifojaza.pdf
    • https://kamapapidez.weebly.com/uploads/1/3/5/9/135962567/7815373.pdf
    • http://piwulag.sportsontheweb.net/advanced_english_vocabulary_with_examples.pdf
    • https://cdn.sqhk.co/tesosunimew/hiDaNgg/nilamojiwurisuvifozig.pdf
    • https://cdn.sqhk.co/tozerutiwezu/2Wiigi5/fopurufedogovuxizi.pdf
    • https://cdn.sqhk.co/tumitibira/aihjhjf/truck_wallpapers_for_cell_phones.pdf
    • http://rowexusaje.mypressonline.com/banking_awareness_for_bank_exams_2020.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://gubadif.myartsonline.com/18843064733.pdf
    • https://d6b7b3c7-8429-4d82-9d75-5d5d09e763cc.filesusr.com/ugd/a8c229_7b9ba357a62445e3b0b4a02c92284819.pdf?index=true
    • https://4ceac43d-3374-4736-8926-b47930641487.filesusr.com/ugd/3b1191_a429c97ede4d415eb230a1c4f972dd62.pdf?index=true
    • https://6c8ebe11-725c-420b-823a-68bc39d02ad2.filesusr.com/ugd/3e87bf_fe058db983884780a85af135c70967d7.pdf?index=true
    • https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_c8cb998a0c074d15a6fa07c22a5c5d50.pdf?index=true
    • http://ladurabazidema.onlinewebshop.net/ap_calculus_ab_derivatives_test.pdf
    • https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_694d1c0b1cde467c8406d8afaf32e86f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e70d.bin
151b489d24cd521cd50a16ce9b298738c6a445ebfd6c54ca0478ee118d9857d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE70D 22380 bytes
font_01_sfnt_off00012ddf.bin
0f7581003c80c757c485bffafac6b35f7610a73ebdbefd91a92af6a42182d11e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DDF 5408 bytes
font_02_sfnt_off00014046.bin
da7e9453882efed20e8dfa6d4c63672db2c857989e2b55de5d984a1d629fc528		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14046 13372 bytes
font_03_sfnt_off00016b5b.bin
2699f2ce65472362c7cce2649b9a1ca315f2f35cd4c84f2de76f8c9cc61a5f56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16B5B 17112 bytes
font_04_sfnt_off000183c1.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x183C1 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.