Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd008bac2ab0a625…

MALICIOUS

PDF

79.4 KB Created: 2021-03-14 01:44:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e906829a40386a87ac13bb7c20999ce8 SHA-1: 15abe1a28be79e506f7b42e4dc82c81443f332ce SHA-256: fd008bac2ab0a62541b3fd5aefb6437b81169ad4ed1ba4f27022abdd0926bffe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The file is a PDF containing numerous external links, identified as a PDF link farm. One of the primary URLs, 'https://jacksth.ru/award?keyword=anexar+pdf+facebook', suggests a lure related to awards or social media. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or distributing further malware. No scripts were extracted, but the structure and URLs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=anexar+pdf+facebook
    • http://rumigiwataj.getenjoyment.net/66550562063.pdf
    • http://komaxinatobofe.medianewsonline.com/fibowaj.pdf
    • http://lexaxak.mywebcommunity.org/dazidesijamazizakutetot.pdf
    • http://tapopapebesawu.getenjoyment.net/accutire_ms-4021b_battery.pdf
    • http://pozijuza.scienceontheweb.net/personality_types_myers_briggs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/02c61ecf-b18e-4743-bfde-4e4ed11c5a48/metodologia_y_tecnicas_de_investigacion_juridica_azua_reyes_sergio.pdf
    • https://e25b7b56-d8f7-44cb-9276-56428e53d1cc.filesusr.com/ugd/63f3e8_ffa24b22fb994b1f8bc0d9b07ae8af6a.pdf?index=true
    • http://rupesujutiwu.myartsonline.com/tefuras.pdf
    • https://uploads.strikinglycdn.com/files/9c79271e-ecdf-4356-9512-8678f2cf545e/jepebasevujab.pdf
    • https://uploads.strikinglycdn.com/files/8193d982-f4b8-4a04-84c4-4064032586d7/52908428211.pdf
    • https://uploads.strikinglycdn.com/files/fee6325f-b96d-4f35-8ee3-c1eeed1437ca/garmin_forerunner_410_strap_uk.pdf
    • https://uploads.strikinglycdn.com/files/caf13bf7-2dde-4d0b-9c4b-b2fd7432acbc/17888461025.pdf
    • https://uploads.strikinglycdn.com/files/aa17d33e-f7d9-422a-8987-15d12fb9f581/stress_management_questionnaire_for_students.pdf
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_5c034a3011f34553804daa3b4ae877be.pdf?index=true
    • https://73ea35ec-f0b0-4773-8bcb-d62b778c7de8.filesusr.com/ugd/a8e976_5f7b3301856947f3a8d7313802d9451b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ff63f14d-e1b0-4a13-aad6-f8bb7876cf00/fovefajalolajutes.pdf
    • https://937a8a2d-b41a-4163-aff8-eda6db263557.filesusr.com/ugd/21e6f2_bf64ef2a5d3245399c55f0bdd3a99347.pdf?index=true
    • http://rukosivujuxu.atwebpages.com/what_to_do_when_water_spilled_on_laptop_keyboard.pdf
    • https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_f6b063b411e441bc8c661598de11d0c1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7b1e6776-cfc5-4dbe-a503-d7401f19779c/hp_deskjet_3054_power_cord.pdf
    • http://wipadafefuxasi.onlinewebshop.net/mdr_zx770bn_pairing.pdf
    • https://uploads.strikinglycdn.com/files/0383b93e-bcc7-4334-ad5f-523c8e0d4259/how_to_connect_jabra_engage_75_to_mobile.pdf
    • http://sekuwomexapa.myartsonline.com/34877905415.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9c1.bin
dbb17ec907eb2f17bd66e1a0de4a93a53bf6dc4b5640db5102c21bb5842ebbdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9C1 5200 bytes
font_01_sfnt_off00010b86.bin
f23a3c660006d670ed04490a15788a9ca9aef67b1425c86c177e99c19e22f70f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B86 10904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.