Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1313a2bef4a424a…

MALICIOUS

PDF

76.3 KB Created: 2021-03-12 20:06:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6926d992524e84456c5145e5597d8fa4 SHA-1: 880115df5dbf82943125beede320d145e9cd77ff SHA-256: c1313a2bef4a424a8a2b772b0417047252f800afd1f3147b24cba50354f753c5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with the heuristic 'PDF_SEO_LINK_FARM' indicating a large number of generated links. The primary URL, 'https://jacksth.ru/award?keyword=aprender+aleman+facil+pdf', suggests a lure to a website that may be part of a phishing or SEO spam operation. While no scripts were explicitly extracted, the PDF structure and link farm behavior are indicative of malicious intent, likely to drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8256

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=aprender+aleman+facil+pdf
    • http://haustova.com/sutetozozujuvelemitokix955wg.pdf
    • http://lifeit.pro/why_isnt_my_power_washer_workingv4qk9.pdf
    • https://static.s123-cdn-static.com/uploads/4449987/normal_5fc57198afe90.pdf
    • http://gijebuk.iblogger.org/miraculous_ladybug_carapace_transformation_instrumental.pdf
    • https://cdn-cms.f-static.net/uploads/4427293/normal_602f31d5840cd.pdf
    • https://cdn-cms.f-static.net/uploads/4475737/normal_5fd830236addd.pdf
    • https://cdn-cms.f-static.net/uploads/4500692/normal_6034c8668eabf.pdf
    • https://cdn-cms.f-static.net/uploads/4366654/normal_6026a53cce2bb.pdf
    • https://cdn-cms.f-static.net/uploads/4427077/normal_60272450e8ae4.pdf
    • http://fimubokuka.iblogger.org/fluke_megger_manual.pdf
    • http://storeeu.info/dasajumamexakakowanijire657vw.pdf
    • http://ufenmac.com/bootstrap_3_checkbox_form-_group4qilc.pdf
    • https://cdn-cms.f-static.net/uploads/4371523/normal_60220fa13435d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_30e2020920c54cd09a6d1cd108790ae9.pdf?index=true
    • http://durozebexonadop.rf.gd/44316211413.pdf
    • https://dedb376b-efc3-4528-ac10-fc65d12f866c.filesusr.com/ugd/5f6074_99f9c7a35df548d9ab7afd6625240d15.pdf?index=true
    • https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_a3181c7ca4f5412c9356d010d0033bf8.pdf?index=true
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_de076bdd70e54ef78884d602d88a7a47.pdf?index=true
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_336f751184f14b9c977bf9fa7d89ef1c.pdf?index=true
    • http://mowesod.epizy.com/bunco_sheets_to_print_free.pdf
    • https://a68e2ff5-bf17-48e3-82d4-ceb975b85758.filesusr.com/ugd/760101_c134b8327c6240309e4646219755f268.pdf?index=true
    • https://502e425a-54a0-4661-a3e6-c6e116bdb13d.filesusr.com/ugd/10da26_8daef71125354c9e94371e071513c156.pdf?index=true
    • https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_4c61baf56a4b4e3ca14400b9db62fe96.pdf?index=true
    • http://bapomel.epizy.com/gonukimifenogofaw.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee07.bin
8058ee37a634dae5e41688220cdd630c9dc369b3096d74582d04de2965549253		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE07 5112 bytes
font_01_sfnt_off0000ff55.bin
51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF55 1800 bytes
font_02_sfnt_off000107e3.bin
97c25cb7a3df8e9054e51de3e449c26ac58a91c8d4b458d99379ae9b72021ae7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107E3 11888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.