Malicious PDF — malware analysis report

Static analysis result for SHA-256 68e603b253f2a463…

MALICIOUS

PDF

75.2 KB Created: 2021-04-01 13:26:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 46727527b3078a0fe30738fd2b671e07 SHA-1: de574f42523c237405611e49ef769d7eb60fe1f6 SHA-256: 68e603b253f2a463f7e4e3a116a654a31a05b4618ef811ae3af35e779f1b5624
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are dynamically generated, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically identified as phishing. The embedded URL `https://jacksth.ru/strik?utm_term=how+to+turn+on+element+tv+with+remote` is likely the primary destination for the user, aiming to exploit their search for information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+to+turn+on+element+tv+with+remote
    • https://cdn-cms.f-static.net/uploads/4470017/normal_605339c6c441d.pdf
    • https://tibulewozimok.weebly.com/uploads/1/3/4/0/134017320/5361767.pdf
    • https://cdn-cms.f-static.net/uploads/4409248/normal_6052d859b54ae.pdf
    • https://cdn-cms.f-static.net/uploads/4411511/normal_60570b3b5ea32.pdf
    • https://cdn-cms.f-static.net/uploads/4368750/normal_6037fa8250abb.pdf
    • https://butilitari.weebly.com/uploads/1/3/3/9/133997497/685565.pdf
    • https://static.s123-cdn-static.com/uploads/4488141/normal_60090adc3db36.pdf
    • https://cdn-cms.f-static.net/uploads/4470545/normal_601f20538999e.pdf
    • https://bomutakarekavag.weebly.com/uploads/1/3/5/3/135330682/b8260ec.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pokorevalaxex/how_do_i_reset_my_lg_sound_bar_bluetooth.pdf
    • https://uploads.strikinglycdn.com/files/3ca8b6f8-4429-483f-832e-62b393f94dd8/xetedoloxavezenawu.pdf
    • https://s3.amazonaws.com/zoromexemuzid/tisapaze.pdf
    • https://s3.amazonaws.com/widuxade/95813953858.pdf
    • https://uploads.strikinglycdn.com/files/213a45b0-347b-4eac-9c73-e0dd5f1c03a7/9186354503.pdf
    • https://s3.amazonaws.com/kefefetafij/louisiana_private_investigator_license_verification.pdf
    • https://s3.amazonaws.com/pesetufavo/kemevunimekafulakodudi.pdf
    • https://uploads.strikinglycdn.com/files/68921cb0-117e-4bae-9b27-62c64232e202/91587288551.pdf
    • https://s3.amazonaws.com/xazarujokemus/how_many_carbs_are_in_a_chalupa_box_from_taco_bell.pdf
    • https://uploads.strikinglycdn.com/files/ed6df1ab-ee00-4277-a05a-6d4c9c53ea05/41682279411.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea86.bin
67314de08d76cbf442540e4847aa6c8f0a8919f7b5deda229c29ec07c65c3a44		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA86 4652 bytes
font_01_sfnt_off0000fa38.bin
599835314ed5f0fba5ff1350bb10895459239b020fbd2ec49ee479ed8a585329		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA38 10932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.