Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf2e0a34b70d1c13…

MALICIOUS

PDF

77.7 KB Created: 2021-04-09 07:13:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 886d9ea042b9079b0f10090ac597d84b SHA-1: 9853476e843c305b58fa2c706dcbcdc0869aa012 SHA-256: cf2e0a34b70d1c13875c78b87ab9efa4857dbcc43934e992b8ecc70782bc07db
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-optimized to appear as legitimate documents. The primary malicious URL identified is 'https://jacksth.ru/strik?utm_term=how+to+use+black+and+decker+waffle+iron', which likely serves as a landing page for phishing or malware delivery. The presence of a PDF link farm suggests an attempt to distribute malicious content or redirect users to malicious sites, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+to+use+black+and+decker+waffle+iron
    • https://static.s123-cdn-static.com/uploads/4421056/normal_5fc78ca973e30.pdf
    • http://gipodobisuweg.iblogger.org/vizatowokisaremedujar.pdf
    • http://formverifiedbadge.com/first_alert_smoke_and_carbon_monoxide_alarm_error_messageermob.pdf
    • http://bobr.space/mugekiwukq70yy.pdf
    • https://static.s123-cdn-static.com/uploads/4378160/normal_5fc944d15b71a.pdf
    • http://lunenakipusuwi.iblogger.org/public_policy_analysis_peter_knoepfel.pdf
    • https://cdn-cms.f-static.net/uploads/4390071/normal_606e1dee575bf.pdf
    • https://cdn-cms.f-static.net/uploads/4413570/normal_5fd184c15f9b1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f51d4006-f4ad-458d-83b9-d4d35b3844e7/what_to_say_in_a_speech_for_class_president.pdf
    • http://watotiwima.rf.gd/cutting_edge_intermediate_workbook.pdf
    • https://uploads.strikinglycdn.com/files/b9265b7c-4f38-4b2f-b966-e87b5c27d43f/19834938902.pdf
    • https://ac402fee-74f4-49a6-b5a4-6a03c6a057de.filesusr.com/ugd/b0cd75_8680712bd28a42f1ac4d3ccd63234e0b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e652fde4-82ca-4682-b6d1-3b50109b5dd3/55066228357.pdf
    • https://uploads.strikinglycdn.com/files/867bf3bc-dc7f-4f4b-bfad-d1c29f6fcb11/makidal.pdf
    • https://uploads.strikinglycdn.com/files/ec40b261-e398-49d0-afe8-ead316128440/asus_maximus_viii_hero_memory_compatibility_list.pdf
    • https://def05634-b969-4265-beeb-1e7d695e9a44.filesusr.com/ugd/6865ce_1e493505efee48aa8117b60666218292.pdf?index=true
    • http://kozolamo.rf.gd/crossfit_workout_routine_with_barbell.pdf
    • https://uploads.strikinglycdn.com/files/c4a32302-dc8e-4281-b983-d5588f3151e3/universal_methods_of_design_bella_martin.pdf
    • https://uploads.strikinglycdn.com/files/67c4f46b-6422-4806-a039-ac9550d0f6f7/pubesavesadivetawixunow.pdf
    • http://zuzofigub.rf.gd/58297011717.pdf
    • https://bc13a564-db4d-4abe-bba9-081b1c4085ef.filesusr.com/ugd/d5ec75_ad66002af8ec477381aa19bbe61fe88e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f134.bin
4173420a1be504bc4a0b609182d8377df99cf3d71fabda1794309b579005d0e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF134 5272 bytes
font_01_sfnt_off0001033c.bin
199c2d4cc297f8a76077b372ca4f88968291f5975a41f69d994f510c731bbb1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1033C 11256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.