Malicious PDF — malware analysis report

Static analysis result for SHA-256 d201d65773c6f15c…

MALICIOUS

PDF

76.4 KB Created: 2021-03-26 07:15:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a9bb6a932e52040a44dd3b5f36febd2c SHA-1: b71a1dda26a940d69f96fc54834a011b26b3ef18 SHA-256: d201d65773c6f15cd4b4a3c0fd092ec41919ca43c6cb53ade80b5de484193fe5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating high maliciousness. The presence of a large number of external links, including a suspicious URL hosted on 'jacksth.ru', suggests a phishing or SEO-based attack. While no scripts were explicitly extracted, the PDF structure and link farm heuristic point towards malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=hercules+and+the+apples+of+hesperides+summary
    • http://distornyup.site/tunofozomikipaxcp574.pdf
    • http://stickerrus.ru/334900439787s4x2.pdf
    • http://alex-chekalev.com/230512811036g2fz.pdf
    • http://samyog.ru/stanley_myers_cavatina_pianozmpkd.pdf
    • http://aicberg.net/savulamoxekebagidujaagr5c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7cc7d595-45a3-423a-a236-edf0cce34e80/doranixerojuwazew.pdf
    • https://uploads.strikinglycdn.com/files/6377e0f9-11df-48fe-9da6-94b839a20e9b/bozepidalinufusi.pdf
    • https://2cc935b2-b854-4d3d-8499-e3bac5ec7384.filesusr.com/ugd/2e82fc_e8925285697844888006f6a3694040a7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7203f587-d2fc-4d3a-88d6-498ec67025d8/my_talking_angela_online_download.pdf
    • https://uploads.strikinglycdn.com/files/8155c6c3-22ed-4198-b78c-937aacf43c65/how_long_can_you_drive_with_flashing_check_engine_light.pdf
    • https://uploads.strikinglycdn.com/files/479472aa-1b33-4c79-81d1-4a14b6a2bd3d/what_to_eat_on_a_no_wheat_diet.pdf
    • https://uploads.strikinglycdn.com/files/ffc564be-3b5d-4088-b089-82ad04717614/34365119948.pdf
    • https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_be832967afa241739970bebe7eb15204.pdf?index=true
    • https://uploads.strikinglycdn.com/files/74e710c2-53ec-473a-ba03-561396d6d89d/togekabagiwujar.pdf
    • https://uploads.strikinglycdn.com/files/733ff51b-85a1-4727-8344-3019d255af88/jozefuduwitejuvuneriketar.pdf
    • https://uploads.strikinglycdn.com/files/18f0d867-27fa-48cd-9cfc-e8b58744ec53/21871135820.pdf
    • https://uploads.strikinglycdn.com/files/3a1b9d56-5ba8-4457-b829-d5a7cd1fb8e2/52427392240.pdf
    • https://uploads.strikinglycdn.com/files/751fc4fb-17e1-46fe-981f-d531b53410cb/42058661410.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec24.bin
88c19d48dbbf83ca64659dd0a7f834053f87b55f5bdc3b6d2bb2d973af193a56		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC24 5456 bytes
font_01_sfnt_off0000fe90.bin
b44771f923e492e4082345f7bc01bbec699eb779702bc0b6029bee9e9c1341d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE90 11000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.