Malicious PDF — malware analysis report

Static analysis result for SHA-256 aeedfa0199854bc6…

MALICIOUS

PDF

80.2 KB Created: 2021-04-11 21:11:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 2e9b93e9e9567b7341a9bc329a2a7836 SHA-1: e92ea035dbfffae940236b0dcd61c87d99745497 SHA-256: aeedfa0199854bc6258f7d6550f2da6bb78950fbc3971db8e4bd170dda7226e8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. The primary URL, 'https://jacksth.ru/strik?utm_term=rhyming+games+for+phonemic+awareness', is presented as a resource for educational games, likely a lure. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and link farm behavior suggest an attempt to redirect users to malicious or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=rhyming+games+for+phonemic+awareness PDF link annotation
    • http://fukiwurezopukof.mywebcommunity.org/draw_straight_line_graph_online.pdfIn PDF document text
    • http://matawobedopikam.mywebcommunity.org/fases_de_la_enfermedad_de_alzheimer.pdfIn PDF document text
    • https://vujipobunovopo.weebly.com/uploads/1/3/5/3/135324227/3d34f3867ae04.pdfIn PDF document text
    • https://fukajupiboxa.weebly.com/uploads/1/3/5/9/135973929/mupigiribir-wogulofebufu-lukivisakija.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410983/normal_5fd8911513384.pdfIn PDF document text
    • https://watoniworawi.weebly.com/uploads/1/3/4/8/134871767/20d2f.pdfIn PDF document text
    • http://fetedeju.mygamesonline.org/effects_of_pollution_essay.pdfIn PDF document text
    • https://sukanoxe.weebly.com/uploads/1/3/1/4/131453950/f80f9d7.pdfIn PDF document text
    • https://jujarodi.weebly.com/uploads/1/3/4/5/134507231/ad30a5b8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445532/normal_600d5ce5290e3.pdfIn PDF document text
    • http://motuteb.22web.org/95088327998.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://35057dd6-1d18-4acd-96c9-af3b7fddc7cd.filesusr.com/ugd/978dd5_02e4e94bf2574fec8c323d7aa0264a15.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gawabog/agnus_dei_piano_sheet_music.pdfIn PDF document text
    • https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_38e2c97ed7b241759bc8f3f81fde4f1c.pdf?index=trueIn PDF document text
    • http://wixudilasajigil.rf.gd/74446088727.pdfIn PDF document text
    • https://s3.amazonaws.com/dazovosugev/hana_sql_format_date_yyyymmdd.pdfIn PDF document text
    • https://s3.amazonaws.com/mejigavukolu/critic_s_corner_ceramic_expressions_answers.pdfIn PDF document text
    • http://voxuluvaj.epizy.com/9145880117.pdfIn PDF document text
    • https://s3.amazonaws.com/vofadoloves/how_to_flip_my_camera_on_my_computer.pdfIn PDF document text
    • https://391e4f24-9fc9-4707-ac06-338edcd9f959.filesusr.com/ugd/110ef3_8c683e2c76d249218099b6973207d4e0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zolerazowubow/47238438866.pdfIn PDF document text
    • https://5e20aa6b-77ef-4f11-9344-5454fb7c649c.filesusr.com/ugd/fb3aa9_4845ace04d4441c5a513107f215ccd97.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f84f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF84F 5596 bytes
SHA-256: 595d221635cdac8443da0caf13784e1b6b3b2334ef1e8d2c9b360e1ec3a84b18
font_01_sfnt_off00010b4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B4F 11264 bytes
SHA-256: 1bd0c3bb01583ba6d5005740d120468505d81e97d196e0451567d4982f3032c4

Open this report in the interactive analyzer, or submit your own file for analysis.