Malicious PDF — malware analysis report

Static analysis result for SHA-256 65ef022a87e61c13…

MALICIOUS

PDF

85.7 KB Created: 2021-05-12 00:19:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b02214faa32385ccef4f41b2b8137f0 SHA-1: 27e52a417d4c8dd76e7e5b67fee3ce18a374f56e SHA-256: 65ef022a87e61c138e86684dacd8dffabf70d8f25d329a870477f9286ab60b2d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are obfuscated or lead to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' heuristics. ClamAV also detected this file as 'Pdf.Phishing.Trojan'. The primary malicious URL identified is 'https://jacksth.ru/strik?utm_term=what+is+the+best+clean+eating+cookbook', which is likely part of a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=what+is+the+best+clean+eating+cookbook
    • https://cdn-cms.f-static.net/uploads/4382953/normal_606d05ad63751.pdf
    • http://fijexojor.getenjoyment.net/how_to_secure_android_app_development_quora.pdf
    • http://gizovivomiz.getenjoyment.net/zinubowazepe.pdf
    • https://cdn-cms.f-static.net/uploads/4401559/normal_604fa48b76131.pdf
    • https://cdn-cms.f-static.net/uploads/4415543/normal_605b39a48ca8b.pdf
    • https://static.s123-cdn-static.com/uploads/4388285/normal_5ff3ea67e9a4c.pdf
    • https://static.s123-cdn-static.com/uploads/4424011/normal_6005151a57a89.pdf
    • http://nukapag.getenjoyment.net/38037161836.pdf
    • https://cdn-cms.f-static.net/uploads/4392220/normal_60514fdd1eb93.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://246406bc-bb0d-4f29-baed-d8a6153a9543.filesusr.com/ugd/3ddeef_f2fe79fdfb0e41eabe6a44b145582427.pdf?index=true
    • https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_583dc20fa319402d8d9e4364f66a6cfb.pdf?index=true
    • https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_88203e5201a44aec94e02c58291ee3b0.pdf?index=true
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_365b51662b2e4c13a01996910b061c52.pdf?index=true
    • https://e50eee24-2d95-422d-8083-6f618d95927b.filesusr.com/ugd/594ae5_5e8e8fe355c44afd96e453cf19ff3833.pdf?index=true
    • https://s3.amazonaws.com/mukutud/71685875016.pdf
    • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_c7477bda641b4066a0815c03c421342a.pdf?index=true
    • http://robefowoved.onlinewebshop.net/western_blot_protocol_invitrogen.pdf
    • https://8d6920c1-aef5-45ed-b1a0-e693d63948fb.filesusr.com/ugd/0a593f_6efe4a2fdb0e46ca8de92e1b7245a59a.pdf?index=true
    • https://s3.amazonaws.com/zonebon/68017586092.pdf
    • http://wesatume.atwebpages.com/kozapilafizuzuxi.pdf
    • https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_42beec215c844383848f12aedf2252c9.pdf?index=true
    • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_e50ea26098bf43f383fe1259a9794649.pdf?index=true
    • https://s3.amazonaws.com/gasodamuza/4280931470.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010293.bin
9b5c0443654ba3c9307e038226f93ee7cb1462d4c91d33df8cb1e3db2384addf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10293 4972 bytes
font_01_sfnt_off00011378.bin
d9b0429d26b60c20c4a390fff21b0ab80165e498f8e7c2c258a1ad7e6495bf08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11378 11236 bytes
font_02_sfnt_off00013976.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13976 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.