Malicious PDF — malware analysis report

Static analysis result for SHA-256 07fac44605fd7374…

MALICIOUS

PDF

83.0 KB Created: 2021-04-06 19:49:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: c885c92e154a375223c1fa07055b80c7 SHA-1: ff7e31d5ca9c36904dba1361d14e726958b43c27 SHA-256: 07fac44605fd73746e29441444f7bd7b000fd3faa3d9ffcf4c6f11d888f8062a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'https://jacksth.ru/wix?keyword=danby+ddw1899wp+manual', which is likely a phishing lure disguised as a product manual. No scripts were extracted, but the presence of the malicious URI and the overall detection strongly suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=danby+ddw1899wp+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369651/normal_606acd751bf15.pdfIn PDF document text
    • http://mubarominufu.iblogger.org/37551981732.pdfIn PDF document text
    • http://pezisafepogux.22web.org/toxikifowazowalisinidalis.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494883/normal_601606142c250.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479451/normal_60679201a5dc8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485012/normal_600b59a113b88.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lesodabat.epizy.com/zufafarujomesaros.pdfIn PDF document text
    • http://batapijas.myartsonline.com/what_is_the_blue_book_listing_for_disability.pdfIn PDF document text
    • http://ruzakema.onlinewebshop.net/summer_infant_custom_fit_gate_parts.pdfIn PDF document text
    • https://s3.amazonaws.com/ribowexulo/what_happened_to_darrell_sheets_website.pdfIn PDF document text
    • https://s3.amazonaws.com/gorajikunobixi/miller_and_levine_biology_chapter_17.pdfIn PDF document text
    • https://s3.amazonaws.com/dorulusof/thinking_fast_and_slow_summary_in_hindi.pdfIn PDF document text
    • http://vaguwiraji.rf.gd/what_is_the_theme_of_fire_and_ice.pdfIn PDF document text
    • http://fosudav.epizy.com/is_the_movie_the_professor_and_the_madman_a_true_story.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/chuunibyou_season_1.pdfIn PDF document text
    • http://xopomumaralula.rf.gd/povukabokuzumuniditamuse.pdfIn PDF document text
    • https://s3.amazonaws.com/fusopoxipo/automation_testing_resume.pdfIn PDF document text
    • https://s3.amazonaws.com/dudurat/99333236503.pdfIn PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/61444698364.pdfIn PDF document text
    • http://zewogukanonudut.epizy.com/all_video_er_professional_apk.pdfIn PDF document text
    • http://zoxokukazo.epizy.com/bottom_navigation_bar_android_code.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eedd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEDD 5564 bytes
SHA-256: e3248b648218dd553e832831362bc2f3a4b6792e7a244b1b24db7c29b159d470
font_01_sfnt_off000101d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101D8 11616 bytes
SHA-256: b2e99b7c7cecab5a2cf1e686ceb0cd45749b5508cbb31881304b7079e5107a37
font_02_sfnt_off00012994.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12994 16120 bytes
SHA-256: f53160ae1e27f28dba4e46cbb69aa7bd11f00c8f0a61c4b1794c691043580245

Open this report in the interactive analyzer, or submit your own file for analysis.