Malicious PDF — malware analysis report

Static analysis result for SHA-256 eeaba26244b4d51e…

MALICIOUS

PDF

72.2 KB Created: 2021-05-23 17:23:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 792831b2aefb04e872f8d6ec80a63a37 SHA-1: e298a520cc120c279d6025b953493a103fb61407 SHA-256: eeaba26244b4d51ecce6c837e200aad9e04fe70fe1b426c143977fa68154b498
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of a PDF link farm heuristic suggests the document is designed to redirect users to external sites, with one such URL being https://jacksth.ru/strik. While no scripts were explicitly extracted, the PDF structure and the nature of the heuristics point towards a phishing or SEO manipulation attack. The document body contains garbled text, suggesting it is not intended for direct user consumption but rather as a container for malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=quanto+mais+o+tempo+passa+leonardo
    • https://waporutonopira.weebly.com/uploads/1/3/1/4/131438234/bbc9c2f85422.pdf
    • https://tolafapod.weebly.com/uploads/1/3/4/4/134486806/juguxexer_geraxug_besivujexop.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/cf386467-654f-4548-a15a-44fabbbf65c5/why_does_my_samsung_washer_keep_saying_suds.pdf
    • https://uploads.strikinglycdn.com/files/6a934105-f16e-49e8-bc5c-05d202c4866a/garmin_epix_manuale_italiano.pdf
    • https://s3.amazonaws.com/kisagoz/congruent_triangles_and_similar_triangles_worksheet_answers_geometry_if8763_page_36.pdf
    • https://uploads.strikinglycdn.com/files/d2cae61a-83eb-4d1d-946c-aaf824d8a2cf/mugobimepipirelunap.pdf
    • https://uploads.strikinglycdn.com/files/b6e15ad2-e4f4-4d8a-88d9-e43db23a52d0/graco_nautilus_snuglock_lx_3-in-1_review.pdf
    • https://uploads.strikinglycdn.com/files/7cc88bff-7322-4247-864a-28e60e166155/winchester_model_12_trench_gun_parts.pdf
    • https://uploads.strikinglycdn.com/files/b9777843-5e90-4070-a3c5-c4259f9ae9ca/50770510092.pdf
    • https://uploads.strikinglycdn.com/files/729dbdd9-4b04-436f-91bd-5de5812a56fb/atwood_furnace_high_limit_switch.pdf
    • https://uploads.strikinglycdn.com/files/cb85e3ad-4876-4f08-b533-f00318b7f9e0/is_it_good_to_mow_lawn_without_catcher.pdf
    • https://uploads.strikinglycdn.com/files/34dfd53e-13d3-48dd-8ee1-467e76ca2642/nazapekujafisuvevijejuj.pdf
    • https://uploads.strikinglycdn.com/files/e9bcb023-bf97-4f83-be69-d8ee82999df9/best_division_2_schools_in_north_carolina.pdf
    • https://uploads.strikinglycdn.com/files/6b3c1e5f-a0a0-4f7e-8ded-1e8ba5f2ab1d/xubemetuzizajod.pdf
    • https://uploads.strikinglycdn.com/files/6f9d49fa-c5b9-43ed-8efc-dcd68d600d3d/25472603160.pdf
    • https://uploads.strikinglycdn.com/files/5382077a-182d-407d-9ba4-95a79bdb674f/charles_bukowski_the_mind_go_all_the_way_hd_motivational_poem.pdf
    • https://uploads.strikinglycdn.com/files/115c5fd9-68d2-4645-be4c-faead98e6f4f/kigawubu.pdf
    • https://s3.amazonaws.com/lolijexejomak/what_word_means_not_taking_sides.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db2e.bin
678db48d793662332db593b314721db6cc8a22a5491c652b863571b0860d1cf3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB2E 5164 bytes
font_01_sfnt_off0000ec9e.bin
7d41c25af6b8bf694eb8d7fcb5472db290dbbdb83344c53800678f0dc516cd54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC9E 11428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.