Malicious PDF — malware analysis report

Static analysis result for SHA-256 78bebc0a4744b226…

MALICIOUS

PDF

82.7 KB Created: 2021-03-15 08:13:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60c9162f72fa57e8f11acdda958379a1 SHA-1: 1fd5868f0948c440d511b235b97332b0a7603e04 SHA-256: 78bebc0a4744b226edf4eb0e2aec72de4a904f56b6ab57f744529366bae24492
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, indicating a link farm or redirection mechanism. The ML classifier and ClamAV both strongly indicate maliciousness. The embedded URLs suggest a phishing or scam attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=principal+types+of+business+activity
    • https://cdn.sqhk.co/benibavagoge/YiaPgjV/takisiwixipominaviv.pdf
    • https://cdn.sqhk.co/zivuronufepu/ihjgHMv/map_of_san_andreas_fault_line.pdf
    • https://cdn.sqhk.co/gufuluzibos/ff6Raez/95217027969.pdf
    • https://cdn-cms.f-static.net/uploads/4384310/normal_6043790021797.pdf
    • https://cdn.sqhk.co/kepozote/hcBB4nZ/crossy_road_unblocked_games_66.pdf
    • https://cdn-cms.f-static.net/uploads/4445570/normal_603a487b73008.pdf
    • https://static.s123-cdn-static.com/uploads/4462368/normal_60037f4f71f52.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/bugutaj/mccutcheon_sheet_music.pdf
    • https://dc383e6d-b7a3-4e67-a88a-227fa542b6c3.filesusr.com/ugd/72b0e7_7a03b1a7ba3646f19910fcbc0a666bbf.pdf?index=true
    • https://s3.amazonaws.com/xajowu/96107330440.pdf
    • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_e28cad3f84ee441c96d020b99496e53b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0e3a7730-8479-4e66-afbf-889df3420d88/how_to_take_hair_dye_off_eyebrows.pdf
    • https://uploads.strikinglycdn.com/files/d48f7c05-76bc-486e-b19b-94e6ecdb052b/twilight_summary_book_5.pdf
    • https://s3.amazonaws.com/bulozor/bumurozuwemowom.pdf
    • https://uploads.strikinglycdn.com/files/2b78c8a2-673c-433f-b28b-08a745c3e21a/59972175370.pdf
    • https://s3.amazonaws.com/jadudusujuje/english_phonetics_and_phonology_an_introduction_philip_carr.pdf
    • https://s3.amazonaws.com/xijalovelokolep/ejemplos_de_metaforas_de_la_vida_es_sueo.pdf
    • https://s3.amazonaws.com/satulibaren/gozopelowomexebulalaboza.pdf
    • https://s3.amazonaws.com/fogibi/50562761328.pdf
    • https://s3.amazonaws.com/kujesulad/tejogovilobesumurejewebas.pdf
    • https://03f57db0-fbcf-46ec-8713-21b5992b8512.filesusr.com/ugd/455f95_4f18760801d04d39a043fae983dd83f7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7c9.bin
5bd38769576bf5cc41b1a70b962cdc8ea4690f248f63cad57b0ea0cc93abacd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7C9 5192 bytes
font_01_sfnt_off0001097e.bin
249a979048516e5fb33e9ccb3a0e50c76ff3fecefa8fd5f918589ae531f70d10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1097E 10920 bytes
font_02_sfnt_off00012ecf.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12ECF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.