Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5bed07363ad457b…

MALICIOUS

PDF

72.8 KB Created: 2021-03-16 20:53:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: cbc39d2662537fd3d3e9a88ff2f53e44 SHA-1: 2ce83a477483be2e452da403a88b5ba9ffac19ca SHA-256: e5bed07363ad457bad161def084e2d640132c5f61ce3091f6020ade4d6f6c232
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is identified as malicious by ClamAV and an ML classifier, with heuristics indicating a large number of external links, typical of a link farm or phishing lure. The embedded URLs, such as 'https://jacksth.ru/strik?utm_term=armor+of+god+priscilla+shirer+ebook', suggest a phishing attempt to redirect users to malicious content. Although no scripts were explicitly extracted, the PDF structure and numerous external links strongly indicate an attempt to exploit users via malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=armor+of+god+priscilla+shirer+ebook PDF link annotation
    • http://linodogeb.scienceontheweb.net/foroxebesaserumivisiz.pdfIn PDF document text
    • http://xajabuzowa.scienceontheweb.net/how_to_pass_itil_4_exam.pdfIn PDF document text
    • http://kefets.xyz/94069097290wgq7j.pdfIn PDF document text
    • http://bosemefawixuwov.mypressonline.com/what_foods_are_good_for_an_inflamed_gallbladder.pdfIn PDF document text
    • https://wanuwajazil.weebly.com/uploads/1/3/4/8/134899981/4252643.pdfIn PDF document text
    • http://idealica-co.site/what_style_of_poem_is_the_raven8mzrv.pdfIn PDF document text
    • http://gagitevanonuti.mywebcommunity.org/chinese_character_writing_sheet.pdfIn PDF document text
    • https://rodamopuxex.weebly.com/uploads/1/3/4/3/134354351/vozulonopemizaw.pdfIn PDF document text
    • http://tiwilofojifig.sportsontheweb.net/which_breville_oven_is_the_best.pdfIn PDF document text
    • https://rezezeveg.weebly.com/uploads/1/3/1/8/131871466/3877031.pdfIn PDF document text
    • https://gibetixogi.weebly.com/uploads/1/3/1/6/131636946/3586230.pdfIn PDF document text
    • https://rudazijix.weebly.com/uploads/1/3/1/4/131453676/nidifire-genunis.pdfIn PDF document text
    • http://siwupojotuj.getenjoyment.net/9113586798.pdfIn PDF document text
    • http://gudelew.mywebcommunity.org/29156979421.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vebisop/oracle_general_ledger_reconciliation_report.pdfIn PDF document text
    • https://s3.amazonaws.com/fomudebipefasu/pazidoledesibaxovusizus.pdfIn PDF document text
    • https://s3.amazonaws.com/jusagi/majuwedunozobetaw.pdfIn PDF document text
    • https://s3.amazonaws.com/woberiz/xopemas.pdfIn PDF document text
    • http://redifigikutusoj.myartsonline.com/dracula_bram_stoker_book_buy.pdfIn PDF document text
    • http://nejimafalun.onlinewebshop.net/business_english_900_sentences.pdfIn PDF document text
    • https://s3.amazonaws.com/sazixipame/22171801691.pdfIn PDF document text
    • https://s3.amazonaws.com/ronatiduzoxij/old_age_pension_application_form_ap.pdfIn PDF document text
    • https://s3.amazonaws.com/libowebujakux/giluzuluriruxedimobubo.pdfIn PDF document text
    • http://laxufazekez.atwebpages.com/88328040914.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE13 5760 bytes
SHA-256: 0ca073744a7b57cacfdb711ecd220e1fff0c09bd3bdcbf71041c58f4b7f75cdd
font_01_sfnt_off0000f18a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF18A 10584 bytes
SHA-256: 40157691a536f0135c6be30d4ceddf723e1c68da95b0b99e6de8a24815512ad5

Open this report in the interactive analyzer, or submit your own file for analysis.