Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fd8245ecb365d21…

MALICIOUS

PDF

76.7 KB Created: 2021-03-16 19:44:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02bc9daed269f99022f594944a48b814 SHA-1: a9558bb585a0faf412f5d685932d6555c08b1c79 SHA-256: 9fd8245ecb365d219e648bfd7ec89fe948d77ec7cfdc6f92226d4a5257fc85c3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are hosted on strikinglycdn.com and other similar platforms, suggesting a link farm or SEO spamming operation. One of the primary URLs extracted, 'https://jacksth.ru/strik?utm_term=what+is+the+job+of+customer+service+assistant', appears to be a lure to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=what+is+the+job+of+customer+service+assistant
    • https://cdn.sqhk.co/xexisini/MrYbihI/bike_ride_london_2019_route.pdf
    • https://cdn.sqhk.co/fekerepusa/hhLOJgd/92147138352.pdf
    • https://cdn.sqhk.co/maduzonuxoke/jf4SiaU/sling_and_jump_mod_apk.pdf
    • https://cdn.sqhk.co/zegodoxelob/JAjhY1v/guxapobiripojiwab.pdf
    • https://cdn.sqhk.co/sutazojawote/bgcBajh/38014951844.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bd3b8069-c6bb-49d6-8280-f14aede8cd4d/ditigatapozize.pdf
    • https://s3.amazonaws.com/paxuvagal/logitech_z623_2.1_speaker_system_-_200_w_rms.pdf
    • https://uploads.strikinglycdn.com/files/d6635d13-67d0-44be-a0c3-3d0d28843f5a/8027346621.pdf
    • https://uploads.strikinglycdn.com/files/0aa70fd5-e902-4e5e-aa66-0c1233ec1b23/fofabudediziviji.pdf
    • https://5121d360-3808-4f61-aa44-d87cf2d9d428.filesusr.com/ugd/032e8a_87ff83799e2540f7a266f7e1800f6bb0.pdf?index=true
    • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_443c1208080044f39b0d78af858e3ab9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a1a5c53b-adb2-4c7b-9ac5-ca266000f9b3/naval_correspondence_manual_point_paper.pdf
    • https://63c5840e-267c-49ed-94d3-fc9f9d8b9c0b.filesusr.com/ugd/8c5bc8_2477e9e4668f4b2ba66c37bb53b15618.pdf?index=true
    • https://s3.amazonaws.com/fekife/10th_tamil_don_guide.pdf
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_79ca13e6c3014c898a96dd360a6dcde6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1e88bd50-7da2-4bdd-b37a-d33c2eeedd54/what_is_the_best_brand_of_inflatable_hot_tub.pdf
    • https://uploads.strikinglycdn.com/files/3acf7132-23e5-4137-9f93-5e24b17b3c85/72726089119.pdf
    • https://s3.amazonaws.com/wekibik/tedipejupagajifovefobame.pdf
    • https://uploads.strikinglycdn.com/files/0aa89ff9-e4f6-491e-a05f-20a95d169be7/psalm_23_vs_1_to_5.pdf
    • https://45f91bdd-2b68-4e60-ae2c-b14373ae5332.filesusr.com/ugd/0d089b_f1b30c80d6564e1ba48f418216e3d993.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b6ba5e62-ccfe-4b59-ad1a-2a79e17391eb/zujezaki.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efd4.bin
7566b6e8b763cf27dd0ac6009bdeeb4a8d4b4603246c76f483b114ab02d2546e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFD4 5380 bytes
font_01_sfnt_off00010208.bin
b4205ff83b5cff0cdd4d87a93f29d7c31ed4cf5f6ec5cf025c50c6a2dc17667d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10208 10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.