Malicious PDF — malware analysis report

Static analysis result for SHA-256 aeaeed55130359a9…

MALICIOUS

PDF

78.1 KB Created: 2021-03-21 00:37:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 84663f6ca5af610ef35c04c67dddd3f8 SHA-1: 98074b42614a00ed7da8f94b81502ceb279d864c SHA-256: aeaeed55130359a99cf89d460f24fc730020bc08af1147f7bccf7da50d912eb9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a link farm on disposable hosting, with a high ML score and ClamAV detection for Pdf.Phishing.Trojan. The embedded URL, 'https://jottigo.ru/strik?utm_term=verbal+reasoning+practice', is likely the primary malicious payload delivery mechanism, disguised as practice material. No scripts were extracted, but the PDF structure and URL suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=verbal+reasoning+practice PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481819/normal_60275d97947be.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4498702/normal_5ff5fa278f6c4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479213/normal_5fdd8b733c5b3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476758/normal_602a1a3b25bd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491946/normal_5fd30ee80164e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480174/normal_600dddb5e423a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dogazisuze/what_does_it_mean_when_a_summons_is_returned.pdfIn PDF document text
    • https://7ce190f9-fb8d-496c-a51a-ce151dcc024a.filesusr.com/ugd/e72def_5d2e52d2f2084d1b8e01deab40f2d247.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tobobowu/august_month_current_affairs_2019.pdfIn PDF document text
    • https://1618b3f4-dcc0-4047-a816-eeb1cbe43c51.filesusr.com/ugd/a01749_766250afe21d486eaff0c1f1542fe7cb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kitakilesa/mujaroxutawitaxobimupi.pdfIn PDF document text
    • https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_49db656bc5994250b654a9353f9666f0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wulagisi/chem_lab_report_abstract_example.pdfIn PDF document text
    • http://bajaxugezozego.rf.gd/bible_study_books_for_young_couples.pdfIn PDF document text
    • http://naxogifesos.rf.gd/85189453612.pdfIn PDF document text
    • https://s3.amazonaws.com/tobito/74901716080.pdfIn PDF document text
    • https://s3.amazonaws.com/wazagidonux/cheung_kong_holdings_ltd_annual_report.pdfIn PDF document text
    • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_6fe17f60d685491e8990b49b45a526a6.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4F8 5208 bytes
SHA-256: 896936a6bcd069cf40d6da4014aaf12b51a149b81c06b1f4fc65b2a6e09d76d5
font_01_sfnt_off000106be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106BE 10772 bytes
SHA-256: addab881f3361eab23c25a6ab40155a67a2a8c2c0dc4ecc35f8a47219b557a0a

Open this report in the interactive analyzer, or submit your own file for analysis.