Malicious PDF — malware analysis report

Static analysis result for SHA-256 7eb9f00818e48bd5…

MALICIOUS

PDF

88.0 KB Created: 2021-03-22 13:03:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 652dcf3a9fa1650f91b65b2b8ee2779e SHA-1: 55262b1cb6de410ac122a2fed6ec8dbe948de18f SHA-256: 7eb9f00818e48bd5ce4afbd9c3d3ab2fb1a0362bcd74da9111d5ad55753f806d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to external PDF files, suggesting a link farm or SEO poisoning tactic. One prominent URL, 'https://jacksth.ru/strik?utm_term=husqvarna+435e+ii+parts', appears to be a lure for users searching for specific product parts. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=husqvarna+435e+ii+parts
    • https://cdn-cms.f-static.net/uploads/4365642/normal_603db35bac3da.pdf
    • https://cdn-cms.f-static.net/uploads/4464996/normal_6050ef6777270.pdf
    • https://static.s123-cdn-static.com/uploads/4371265/normal_5fe3ecfa6cf8e.pdf
    • https://static.s123-cdn-static.com/uploads/4387709/normal_5ff7c92bb838e.pdf
    • https://cdn-cms.f-static.net/uploads/4490272/normal_604ecc0709dbf.pdf
    • https://static.s123-cdn-static.com/uploads/4383475/normal_5ffdb22c3791e.pdf
    • https://static.s123-cdn-static.com/uploads/4380674/normal_60038b254e3e3.pdf
    • https://cdn-cms.f-static.net/uploads/4374175/normal_6034cb466e0b1.pdf
    • https://cdn-cms.f-static.net/uploads/4469617/normal_6051568c92222.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f7c4b7f6-3d37-40b8-88b9-0adf01557624/tuwepodutok.pdf
    • https://uploads.strikinglycdn.com/files/0c67349f-d0a8-40af-bf7e-d62e758b0c77/zufuwamedogoxi.pdf
    • https://9a1eab6f-da2d-4a41-99bb-18a59f11b130.filesusr.com/ugd/c2b690_c4fac57a1197470da466f3adbd472699.pdf?index=true
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_12091034064c40c9b332617499c7c72d.pdf?index=true
    • https://83bd47e3-138d-48d8-8d00-514fe13b91b0.filesusr.com/ugd/c87a2f_15f91149e10441f8980ce275e02be805.pdf?index=true
    • http://xolekazejufu.rf.gd/btc_private_key_finder_apk.pdf
    • https://uploads.strikinglycdn.com/files/a8e1a927-709f-416c-8339-2eaf8a816d84/moen_monticello_kitchen_faucet_parts_diagram.pdf
    • https://uploads.strikinglycdn.com/files/44647db8-7493-4b3c-bd0f-f6479fb543c6/kapakaxozujapudoxibo.pdf
    • https://a52dd608-e7dd-4d50-8005-e0fd7a3896b4.filesusr.com/ugd/43d2fc_c08ee22b5f0a4cc49d1e71666b4a57f8.pdf?index=true
    • https://8c0e102b-efba-4641-b7fc-347c26357927.filesusr.com/ugd/d420ee_0e01be5942b44c8492b2697140d5f0aa.pdf?index=true
    • https://f3215690-35ba-4bce-915f-db1a6f912a1b.filesusr.com/ugd/d32599_0ab1bafd5b5349bab32e0280a9ace47e.pdf?index=true
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_8ca36f3cd5834399a68a46b690ab2be6.pdf?index=true
    • http://juwesuzibu.epizy.com/action_sheet_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c1d.bin
33d65b6bea06b34ae210b398472b134fbcc282140832b79d1504c8ab6c3494ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C1D 5304 bytes
font_01_sfnt_off00012e4b.bin
dd54235289b97dd16eb0a25d64e6ee203f2527264a43f06c09d09a3f0253b530		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E4B 10876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.