Malicious PDF — malware analysis report

Static analysis result for SHA-256 004a08d5b8e7f11b…

MALICIOUS

PDF

123.3 KB Created: 2021-03-12 00:45:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 05c42e68ee5d76678192b889d0bc0e98 SHA-1: 2c0749eb1cfb2b23bcef8c96c962dd6219ffc17e SHA-256: 004a08d5b8e7f11b5bc439e719789a675ebeaa31c63bd3b57f3da0ebd4f2d7a1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://jacksth.ru/award?keyword=arquitectura+del+renacimiento+pdf', which is likely a phishing lure. The document body is heavily obfuscated, preventing a clear understanding of its specific function beyond the embedded URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=arquitectura+del+renacimiento+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4421612/normal_5fe2ba40dff8d.pdfIn PDF document text
    • http://sdorovie-sustavi.xyz/691700889501nzfg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416150/normal_5ff4582a510aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469103/normal_603c525285289.pdfIn PDF document text
    • http://moxupasasitote.mywebcommunity.org/52931041749.pdfIn PDF document text
    • http://tujukesabegakom.mygamesonline.org/19189543341.pdfIn PDF document text
    • http://kelnoteres.xyz/what_sound_do_goldfish_makewzjq9.pdfIn PDF document text
    • http://riwozizedilar.mygamesonline.org/are_there_carbs_in_taco_bell_mild_sauce.pdfIn PDF document text
    • http://magnifioco.site/42875137830v8uce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404755/normal_5fd0b6b881bbd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417526/normal_5fe356a62343b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501810/normal_5fc8a4d2c237b.pdfIn PDF document text
    • http://dompodklyuch.com/cyberghost_6_crack_free_apklx4s9.pdfIn PDF document text
    • http://bt-management.website/1123810512en469.pdfIn PDF document text
    • http://invitesistem.ru/19765978637dyl0i.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443594/normal_5fec3367daf7f.pdfIn PDF document text
    • http://ersoil.fun/127274436067kxmj.pdfIn PDF document text
    • http://prognoz-football.club/17788301864id891.pdfIn PDF document text
    • http://forovasax.medianewsonline.com/microsoft_access_2016_requires_visual_basic_for_applications.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4391620/normal_5fcaceffde506.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375341/normal_601ca78915d3c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391047/normal_60469cdbd400d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/407c2c4b-25eb-477e-819c-3e42c30eb36c/what_factors_influence_social_perception.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96a76da3-52cf-4506-938b-feabe892f6d5/bissell_proheat_2x_revolution_wont_spray_water.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d6270bc-6196-4140-8431-67872124bf33/group_games_outside_no_equipment.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6b81133-0636-4289-a932-a204e202e7bb/zuberejan.pdfIn PDF document text
    • http://zalatikewal.atwebpages.com/nisidamegasizulanovalit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10ed30c7-ec52-4043-bea1-7f1d72cb0051/vobutirulamojanenutupafe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019d78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19D78 5236 bytes
SHA-256: 5a967276e4f19041498cd7358bdcb562fad415372366213768f0f9a2a871eb73
font_01_sfnt_off0001af35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF35 15896 bytes
SHA-256: 0e8e46a642206e3fd22737d874a965266c901766f78919bab8d3220376c8d854

Open this report in the interactive analyzer, or submit your own file for analysis.