Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1b988d2d0bf28fd…

MALICIOUS

PDF

93.0 KB Created: 2021-03-25 13:45:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 0c46ab83b0df9fa50490fad3b4fb972c SHA-1: 21c1b9557d7d2ec17ea16688ac1395b30aa6b708 SHA-256: e1b988d2d0bf28fd762898cde01759db5c5af04c7ea1e15c16668ec68b2d78b8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are to PDF files, suggesting a link farm or SEO spam operation. One prominent URL, https://jacksth.ru/strik?utm_term=the+story+araby+by+james+joyce+summary, is presented as a book summary, likely a lure to drive traffic. ClamAV and ML classifiers also flagged this file as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=the+story+araby+by+james+joyce+summary PDF link annotation
    • http://vuwevemup.22web.org/74349959757.pdfIn PDF document text
    • http://fudasoba.iblogger.org/colts_injury_report_chiefs.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/baxunaf/94066207872.pdfIn PDF document text
    • https://s3.amazonaws.com/wopari/kaxejemidegaxu.pdfIn PDF document text
    • https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_043ab7fe46da4081b84e2548bc2df447.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a204d3bd-abb0-48d1-a00f-2a310dacb36b/dirty_panda_joke_eats_shoots_and_leaves.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9ac1871-ed5e-4255-8c25-41e09c78b29e/rejiritogoriwa.pdfIn PDF document text
    • http://wedofisirix.epizy.com/32178271198.pdfIn PDF document text
    • https://da25564d-e3c2-4b9b-87ba-dd8ce2ae78d4.filesusr.com/ugd/c82cd6_c458c8214d074d62834e2fc65561abef.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/acbd0aac-c6ca-4187-a9bf-33d043950b60/why_do_you_want_to_hurt_me_quotes.pdfIn PDF document text
    • https://s3.amazonaws.com/dazuxujepov/58974524420.pdfIn PDF document text
    • https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_bef120edc5d44e9a90d2aab86929b0b2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/4th_grade_math_worksheets_multiplication_and_division_word_problems.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2824bca-0669-4744-ad7e-897d4291b518/miritiraja.pdfIn PDF document text
    • https://e1cd7dcf-8988-4be8-9b1a-722367337987.filesusr.com/ugd/6203b9_373234db6b684bf1881f08d1f45c49c3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nelizenejakarug/76129863283.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90916cfb-791b-48a2-8a12-9b9dc0a6a2de/67096668885.pdfIn PDF document text
    • https://s3.amazonaws.com/vukusa/vpn_master_unlimited_proxy_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/dipafuxe/61885286729.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ebd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EBD 5272 bytes
SHA-256: 16a1db939bc6ca5394d03d8b111d3db00f6693c88d72a3c6ef7d563777e55e85
font_01_sfnt_off00014090.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14090 10664 bytes
SHA-256: 17dd51ccf1b7fc7f9e003cc550a5269491325d93071629f4681f2ecce46e2e60

Open this report in the interactive analyzer, or submit your own file for analysis.