PDF malware analysis — malicious · d9a24a237495462a

MALICIOUS

PDF

71.7 KB Created: 2021-03-05 19:55:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02

MD5: 4801e61f51f8bbd4a08d6ab7651ecfb6 SHA-1: 30eebd1979e6c7cc913756e2c1b23dab44d8682e SHA-256: d9a24a237495462ad95cf687c8518da0c0ff3a35fb842f36a68b166755d08476

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains a large number of external links, indicating it functions as a link farm. The primary malicious URL identified is https://jacksth.ru/wix?keyword=destructive+wave+dnd+spell, which likely serves as a lure or redirects to further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/wix?keyword=destructive+wave+dnd+spell PDF link annotation
- https://cdn-cms.f-static.net/uploads/4483346/normal_600ef7fe64f7a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466664/normal_603b1b4b23264.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4502188/normal_5fedea37f2fe2.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4498997/normal_6005a69020768.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422378/normal_60246c4e35101.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://d992f69e-bc5b-430a-92d7-abfd66d0380b.filesusr.com/ugd/6f7357_12eb3eba4b5a435394d4242a389f307b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tiniruru/c._s._lewis_the_four_loves.pdfIn PDF document text
- https://7be8961d-effb-4c78-a255-78c3c9f0be09.filesusr.com/ugd/3dd68e_f6e992e2a17d4091aabfb90b49cb6c2b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wukara/mudesidamumipijera.pdfIn PDF document text
- http://lezebotetojezaz.epizy.com/personal_swot_analysis_template_ppt.pdfIn PDF document text
- http://jidabalelibixu.rf.gd/23455710416.pdfIn PDF document text
- https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_3ab9277dc02c4c2d9df8c224bd163ded.pdf?index=trueIn PDF document text
- https://2e03c77f-99cc-4591-9807-54d8d49c9ce6.filesusr.com/ugd/759733_9931e62b34f84dbeac4b969f64fc9ce2.pdf?index=trueIn PDF document text
- https://d90bda3b-35dd-409f-9d4b-b4a00d881a52.filesusr.com/ugd/b88e3d_4b24a3d2711643f881e95d7cf044cb86.pdf?index=trueIn PDF document text
- https://c96d0889-97fb-4213-90a4-a08ae01970e6.filesusr.com/ugd/ed32f2_2fdcfc6b112049639569d6c5ba770263.pdf?index=trueIn PDF document text
- http://mimiwuzoxul.epizy.com/cardinal_wiseman_birmingham_uniform.pdfIn PDF document text
- https://f6ce3cfb-f922-470c-9e0e-eaf724001b0e.filesusr.com/ugd/defcb2_58351326bd3f458f9450bd3d49ccca53.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cfc3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCFC3	4988 bytes
SHA-256: `8b6012647b60362a677929c4499a0a98ae08e2ce5b77a98aaba3200c8065f7c5`
`font_01_sfnt_off0000e0da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE0DA	10216 bytes
SHA-256: `4661276f85caeabf1be6b7eac9c884cf205935fd1e2bac01c1829219d279d4e1`
`font_02_sfnt_off000103e1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103E1	4324 bytes
SHA-256: `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`

Open this report in the interactive analyzer, or submit your own file for analysis.