Malicious PDF — malware analysis report

Static analysis result for SHA-256 d59cf2e7e49cf145…

MALICIOUS

PDF

69.9 KB Created: 2021-03-18 21:05:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b9f16cf2ec6d3a6ddf41122c8968f9b SHA-1: 7297fd8bf55783ceee68151058787e2ec22c1ffb SHA-256: d59cf2e7e49cf1458dd6ca696d1f18dd1bbdd8d5c6a7bb54bd9e2d07089bed0f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, identified as a link farm, with the primary suspicious URL being https://jacksth.ru/strik. This suggests a phishing or malware distribution attempt, likely delivered as a spearphishing attachment. No scripts were extracted, but the PDF structure and numerous external links are indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=jotul+602+specs
    • https://cdn.sqhk.co/dodanadofu/achdhhb/ludipov.pdf
    • http://douchehub.xyz/aquatic_animals_listfeemb.pdf
    • http://garant-ritual.online/fapudekosekidowu8k7on.pdf
    • http://tixshopclub.space/fesiwezalemilogijewq5j3.pdf
    • https://cdn.sqhk.co/pazaxefuma/hbo7Wjj/race_film_tom_cruise_dustin_hoffman.pdf
    • http://espaceabonnes.com/yahoo_email_for_android5srrp.pdf
    • http://reduslim-officialsite.site/colon_cancer65g1s.pdf
    • https://cdn.sqhk.co/zivuzigup/2sidL7G/97165125320.pdf
    • http://tewatag.medianewsonline.com/lamuxemeg.pdf
    • https://cdn.sqhk.co/tulotunofuz/hbIfgfB/no_man_s_sky_xbox_series_x.pdf
    • http://jakusavu.sportsontheweb.net/pathologie_de_l_appareil_digestif.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0e01c86c-6ad9-43de-bc04-b8819f410213.filesusr.com/ugd/73c254_6b2b62f374f64bb0b03566ea5fc967f9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/92842b93-56b7-4d77-8b6c-0d11aa19f432/58639348727.pdf
    • https://uploads.strikinglycdn.com/files/3e17b707-ff48-4d34-8af6-2df3fb0ad182/65101880141.pdf
    • https://uploads.strikinglycdn.com/files/c2667386-9b50-45e5-b622-d41a111aa7be/best_us_history_research_topics.pdf
    • https://uploads.strikinglycdn.com/files/6d30dfd2-d3ce-4cb0-9cdb-81dcd956636e/16054939812.pdf
    • https://uploads.strikinglycdn.com/files/8a734236-ae0a-4cca-b418-563fd9d4ba90/nodizefazamabavodup.pdf
    • https://uploads.strikinglycdn.com/files/e19b33b2-7590-4757-9665-2f7005b53954/lexus_es300h_2014.pdf
    • https://uploads.strikinglycdn.com/files/69798a07-b4d1-43be-9986-59b5c452f69d/pezavigud.pdf
    • https://d934ed86-632c-4751-b35b-4303166f997e.filesusr.com/ugd/be0f55_38cedf287e6b4ef28f5f24d971db3f75.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4ebb8bdb-b1db-4877-a8e3-5eda21d7daa3/31421554743.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d14e.bin
9da5ebd2e52bc125eb3d6d84d31f2cc1b177edbda1e9c2545a22729099a51eec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD14E 5036 bytes
font_01_sfnt_off0000e292.bin
a0f61017132f7da759bdfc369670866644ba18a5356b01e1c84e70e1ea36b764		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE292 11408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.