Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e481f6f714ac426…

MALICIOUS

PDF

69.7 KB Created: 2021-02-15 17:53:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 0c565e8b1705149fdacb55624bedca04 SHA-1: d77cea683d67be1890012950343c053963d46ee9 SHA-256: 0e481f6f714ac426c8b67e9659d1fb47c1d3e9bed8531fd26ec93f59cdc6083d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to 'jacksth.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=the+iceman+inheritance+pdf+free PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4489595/normal_5fe411e30c287.pdfIn PDF document text
    • http://goodsun.space/beast_battle_simulator_free_play_online8xl6h.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483839/normal_600879b07a90c.pdfIn PDF document text
    • https://vubopedu.weebly.com/uploads/1/3/6/0/136083963/zezigotitinavu-piwawipu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487197/normal_5fe5fa2cafe34.pdfIn PDF document text
    • https://cdn.sqhk.co/futidiwe/aOigXK3/17935941140.pdfIn PDF document text
    • https://xuzipitazejaj.weebly.com/uploads/1/3/4/7/134722028/sisuwovejiz-vokafafuxedupar.pdfIn PDF document text
    • http://beststudent.space/catchphrase_answers_episode_7_round_1t6gmg.pdfIn PDF document text
    • https://cdn.sqhk.co/setewefasari/hgieRyt/trivia_crack_2_power_ups.pdfIn PDF document text
    • http://gefejisu.22web.org/vlookup_guide_excel_2010.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414331/normal_5fe6bbc8b88c2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402246/normal_6015d333338b3.pdfIn PDF document text
    • https://cdn.sqhk.co/galemojubemo/jbrwigN/t_mobile_customer_service_chat_usa.pdfIn PDF document text
    • http://vquest.website/jejenofavedebexaroxakeqz0b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449600/normal_5fc72f7b49fbb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366017/normal_5fd68a4a0a216.pdfIn PDF document text
    • http://axecheat8.xyz/clash_of_clans_th8_war_base_copy8y3vv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCCBA 5136 bytes
SHA-256: 54cd969e113e59c4e4ab8ee238dac9b72ac1862610bfe3555f9ac4d13ed83326
font_01_sfnt_off0000de09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE09 13124 bytes
SHA-256: fbbac444f7a5b5dddb5141a0ad47e3df8b1c5f0c12e6a6941fb4f5347f9fbc11

Open this report in the interactive analyzer, or submit your own file for analysis.