Malicious PDF — malware analysis report

Static analysis result for SHA-256 0467968381b943d0…

MALICIOUS

PDF

130.2 KB Created: 2021-03-18 10:42:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 37690816d4f829705fe8226bd4f775ce SHA-1: e8737bbbc800cdf53ba85a16496063bdb50c8e54 SHA-256: 0467968381b943d066e2711300ca093e6463172b6715e66a3285752cdf417e30
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL pointing to 'jacksth.ru', which is likely part of a lure to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a topic related to physics, likely a pretext for the phishing attempt. No scripts were extracted, but the presence of external URIs is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=porque+es+importante+la+fisica
    • http://komanegeze.22web.org/vatican_assassins_wiki.pdf
    • https://cdn-cms.f-static.net/uploads/4410976/normal_602980253c205.pdf
    • http://fuzubijixulux.mygamesonline.org/how_to_convert_jpeg_to_jpg_on_phone.pdf
    • http://sesesuruko.mypressonline.com/29106438991.pdf
    • http://nikibolerobika.getenjoyment.net/science_of_mind_criticism.pdf
    • http://garanibukumom.scienceontheweb.net/xivuforavewazepavo.pdf
    • http://giboxibefelas.22web.org/kikapiwiduzelulevad.pdf
    • http://wapadax.scienceontheweb.net/att_induced_hepatitis_management_guidelines.pdf
    • http://leseweremizew.scienceontheweb.net/how_do_i_get_ij_scan_utility.pdf
    • https://cdn-cms.f-static.net/uploads/4477183/normal_6017259e8b6ed.pdf
    • https://cdn-cms.f-static.net/uploads/4427313/normal_5fd8926174f10.pdf
    • http://gomunawuwox.22web.org/64023780475.pdf
    • http://lalikexitaxixix.getenjoyment.net/sexatopupodedepinoteloju.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://48936d5e-4b15-4059-a328-ddb12afcc15e.filesusr.com/ugd/173145_9e66704d99324f91ae394c9683ffca9b.pdf?index=true
    • http://nujowizuwumug.rf.gd/leasehold_advisory_service_advice_guides.pdf
    • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_fa1e8218b687456a807704c5cf4bff9d.pdf?index=true
    • https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_75f8adc99fc743a5bd5a41fcb8ebe441.pdf?index=true
    • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_eca4ed2bd85644fabc759952656b7858.pdf?index=true
    • https://78151a86-a557-4e49-81aa-a2539eea45c7.filesusr.com/ugd/204f4f_461e32744e0448bfaaca37d3ea173aef.pdf?index=true
    • http://xolevusafo.myartsonline.com/grade_3_ac_joint_separation_icd_10.pdf
    • http://bowupezik.epizy.com/windows_cannot_format_64gb_sd_card.pdf
    • https://d872ce2a-2baf-4032-ab86-ab75b2f66d52.filesusr.com/ugd/338562_964aee2be1744098835b101cc3481974.pdf?index=true
    • https://e510c2d5-567e-4a96-89ff-abc18316baf7.filesusr.com/ugd/8a9bcc_1c51a73b20e94676b9cb8381a16ac10a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001babe.bin
36998a60fcc72d0c1d1cb3d1c48267fc5ca5b04d76528a5b9379a5a9593432d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BABE 5288 bytes
font_01_sfnt_off0001ccab.bin
5ce5ef1212491ea9434f4f310cbb990a488824d237c380c6d871129e5b75c847		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CCAB 14236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.