Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4e30befa1e1ae90…

MALICIOUS

PDF

103.1 KB Created: 2021-03-19 03:49:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: a62294f36b23b3d184ced234391886e3 SHA-1: e1df72c006ff85e6970a563f987de0dda079a517 SHA-256: c4e30befa1e1ae90ccc250a66f83cd5a43326c9772c0f5808f01f51edcd596c6
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting it functions as a link farm designed to redirect users to potentially harmful websites. The presence of the URL 'https://jacksth.ru/strik?utm_term=why+did+artemis+kill+actaeon' further supports this, as it appears to be a tracking or redirect link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=why+did+artemis+kill+actaeon PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://73c25812-7308-4b32-b985-10e2a25710ca.filesusr.com/ugd/5b604d_2b559232bf5f443d8735f90c39e8aab4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/198f9887-ee32-4927-82d8-129234b5b804/regal_kitchen_pro_bread_machine_k6745s.pdfIn PDF document text
    • https://d427386d-3434-45d9-8802-370857a594f4.filesusr.com/ugd/accd1f_bf1608c4dd5c40b88ed8ecaae35c2c53.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cba21e4c-9170-4915-8169-688689914d38/pasos_para_preparar_un_bosquejo.pdfIn PDF document text
    • https://3568c1c9-c281-4b9a-9ea9-d5d291e0176b.filesusr.com/ugd/e5d8db_efef32e36f5f4d06bd035886d996663e.pdf?index=trueIn PDF document text
    • https://307a23dc-bb60-4906-9a68-69e45957aa19.filesusr.com/ugd/d2057d_eeb39fbee8e44d4eb85ee765aebf2ca8.pdf?index=trueIn PDF document text
    • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_4349018a7a8740d2982dc1b6c7469ac0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e00a312c-f6fa-46b5-921a-545a0c0e3d29/38019280224.pdfIn PDF document text
    • https://9042e326-c85f-44e6-b9b6-0c206471fdba.filesusr.com/ugd/0d2fda_d0c38fdc302c49ff822f60ff0ed7b4e1.pdf?index=trueIn PDF document text
    • https://e3055f73-6236-423b-b810-4bc1a15f300f.filesusr.com/ugd/fa12d1_3ec11ad8e0a34040b0f76d9984d5fa80.pdf?index=trueIn PDF document text
    • https://434dcbc4-7bd9-40fe-99bf-e102daebf961.filesusr.com/ugd/07ef24_fe97e22d4b8a4c5fa17763b4e69ec9d3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/acd92ebd-cee2-4172-959c-44cb09ad3fa0/who_is_on_the_cover_of_the_sports_illustrated_swimsuit_issue.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eca6fdce-eac1-4d23-9220-be16bf99aea3/sample_behavior_modification_treatment_plan.pdfIn PDF document text
    • https://58eafb2e-ea74-4523-a1b2-d2e0fe9bfe54.filesusr.com/ugd/466fa0_49b9d23282fd4c678e96c53687a79816.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ad43926-8b6c-4855-9a6e-3f144f79c462/how_to_use_vacuum_seal_rolls.pdfIn PDF document text
    • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_8217a1ca0cba4ec68fb09187119b9b98.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2185e3b-104a-4b2a-85d6-9413ae46f420/pamajugilixigigeweza.pdfIn PDF document text
    • https://5cbbff6b-7c47-4fbb-abda-9de5069fbc88.filesusr.com/ugd/1a89c8_e6d2b250b40e4dd3a8fa4ce2dbb8c007.pdf?index=trueIn PDF document text
    • https://ee809a51-a58d-41df-a269-13688c4e1c69.filesusr.com/ugd/5f587b_6ee592eb836e40ff8af9c7e188804fd2.pdf?index=trueIn PDF document text
    • https://e924225a-aa46-4bfc-8e56-7341551e1833.filesusr.com/ugd/54dfea_fba40ed56165487893e54784f7c0b635.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d852ec99-7473-45e7-9c57-3c3a30a3a770/89251200477.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001334d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1334D 5360 bytes
SHA-256: e91668a905d8cb63eaeb413faeb4564a7f88d3fb3e361d1c31a5446fc749829a
font_01_sfnt_off0001456d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1456D 17496 bytes
SHA-256: 58f488d2d893de63930b8c565dc620aa7e9ea1ee0e90dd66ba8e25324b2b559b
font_02_sfnt_off00017969.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17969 16140 bytes
SHA-256: 2732c78df68b4531e26da51a256f0f9ab881cb8a96d1886ade34872d88eeece3

Open this report in the interactive analyzer, or submit your own file for analysis.