Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3cf59bd35a754e6…

MALICIOUS

PDF

71.7 KB Created: 2021-04-03 00:16:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe2d390995d11f01f7bb6e2aa458d408 SHA-1: 94156f4e48bedb9e8e86510adc77e67df67716be SHA-256: a3cf59bd35a754e6d1679ed3dd615c9f0e0e94d5e5a5e676dde51fbac9129c92
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. It contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results or direct users to malicious content. The primary malicious URL identified is https://jacksth.ru/strik, suggesting a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=vw+dsg+transmission+fill+tool
    • https://cdn-cms.f-static.net/uploads/4450724/normal_6019d9ccd3340.pdf
    • http://kugaraginoja.mypressonline.com/kimazefir.pdf
    • https://static.s123-cdn-static.com/uploads/4408323/normal_6006b090030b7.pdf
    • http://kogowetek.getenjoyment.net/fish_farming_business_plan_in_india.pdf
    • https://vapigoje.weebly.com/uploads/1/3/5/3/135391726/kadov-vegisuju-tefunato.pdf
    • https://vusexojepaxeva.weebly.com/uploads/1/3/4/0/134096357/wujaxurawenuka.pdf
    • https://sujumakatu.weebly.com/uploads/1/3/1/3/131379709/nirutodemesufawufik.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5f049732-8353-4b08-a2fd-ada6e0c9796b/2008_honda_civic_service_light_reset.pdf
    • https://53f03ce6-db0b-4f41-9bfc-6956ba41e1f4.filesusr.com/ugd/727e0f_425218e06b7c4f03a282674a34aa078d.pdf?index=true
    • https://dd907c4b-492b-4b4d-bf3c-9f0b7a2bd2c7.filesusr.com/ugd/96a426_bfdf060a45a64ef99e3888f89fc5d925.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b466efc1-1037-414f-b702-d0946c4b2fb0/burger_king_nearest_me_phone_number.pdf
    • https://uploads.strikinglycdn.com/files/bba558ac-6f6c-4554-a4f6-76616d8cd5d8/how_to_analyze_graphs_of_polynomial_functions.pdf
    • https://s3.amazonaws.com/zidenigad/95722553619.pdf
    • https://37976aa0-f55f-47d3-847a-8d185b13ebf6.filesusr.com/ugd/1d6212_d591f74a1ee545a3bd42c5a83e0a9409.pdf?index=true
    • https://s3.amazonaws.com/zuponefi/pezojawajopozib.pdf
    • http://dipagepe.atwebpages.com/wizawoperodip.pdf
    • https://s3.amazonaws.com/paxunu/kisuradozuvevunamapudomu.pdf
    • https://711a90e7-97f2-4eab-8690-3003ec1e9b64.filesusr.com/ugd/a0905b_a9cf07f59fdb45e88a5a6c687abfb288.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cbf0ba84-3867-4a9f-88ee-d295db552a38/ez_go_golf_cart_transmission_problems.pdf
    • https://938a05da-450f-421e-a59b-0448473a402a.filesusr.com/ugd/cb5dea_1f44cd2294fa46a4a2085841340df60e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd8d.bin
ef0785857f30209f4a0291473998e842ef74880e22c06677f8e4919746fdeb2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD8D 5284 bytes
font_01_sfnt_off0000ef88.bin
5a2dcd70250aabf57e19f74b6ff475cb047286ab99a3317abb160daa6c3440cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF88 9916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.