Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ac7baef95f20499…

MALICIOUS

PDF

83.4 KB Created: 2021-03-19 04:30:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 36c4781a3eb49927ff83f74eced33da2 SHA-1: 2db013d22bb1af43011551390fdcff068c2f3ccb SHA-256: 1ac7baef95f20499cd97b9abf39f841685e851bf6cf80044309036f3f01a4a17
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://jacksth.ru/strik', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=who+built+the+moon+shinyribs+meaning
    • http://muxonobugimaki.22web.org/16445697349.pdf
    • http://zugapuvu.mywebcommunity.org/how_to_avoid_pattern_day_trader_rule_robinhood.pdf
    • http://pixizosusonaxij.sportsontheweb.net/ap_grama_sachivalayam_syllabus_in_telugu_2020_download.pdf
    • http://sakulog.sportsontheweb.net/audiocodes_mp-114_manual.pdf
    • http://pokinusuvato.getenjoyment.net/bicycle_repair_manual_chris_sidwells.pdf
    • http://kevarusakoko.mypressonline.com/lezesubab.pdf
    • http://xatovapotogu.mywebcommunity.org/bjt_as_amplifier_and_switch.pdf
    • http://fafesixokegigi.getenjoyment.net/what_does_a_service_led_economy_mean.pdf
    • http://dorugatutaxovi.scienceontheweb.net/zoxudagakisapu.pdf
    • http://fukuzowi.sportsontheweb.net/bemoziz.pdf
    • http://kogowetek.getenjoyment.net/fish_farming_business_plan_in_india.pdf
    • http://zokidinodajives.getenjoyment.net/labopulez.pdf
    • http://kazexezawulozij.mypressonline.com/kubisavoge.pdf
    • http://zodatowafe.getenjoyment.net/craftsman_electric_edger_parts.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://teropisarazo.myartsonline.com/93551493337.pdf
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_4e7c97d0449648d48030eb87d30aecfd.pdf?index=true
    • http://givetupazowo.onlinewebshop.net/ap_biology_textbook_campbell_11th_edition_free.pdf
    • https://b7e73dfe-ad35-4791-b4f7-7500f5b7882c.filesusr.com/ugd/bc79a4_4e9dcdaf2a6a427aabc827915fdbfc95.pdf?index=true
    • http://leparitupoxow.onlinewebshop.net/15787790985.pdf
    • http://puwevaladimeve.epizy.com/vukagube.pdf
    • http://kikukuvikato.myartsonline.com/pixibawuxufafa.pdf
    • http://jarepumemaxi.onlinewebshop.net/livro_alter_ego_a1.pdf
    • https://6cda4dd4-8aac-43e7-8003-7c0eea9f7907.filesusr.com/ugd/34e26e_518be062638d4980a1c10b1bd4f12905.pdf?index=true
    • http://jugugesazo.myartsonline.com/jugajukusuk.pdf
    • http://vorisenunajix.myartsonline.com/how_to_make_manual_in_word.pdf
    • https://44879a12-c10a-431c-a98a-7de142752d0f.filesusr.com/ugd/bb4607_4617e3efcb9349369d83bc08c70d44f1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f966.bin
439471256207dbab0976fae456cbf116c38d615e7f77b0da3d546ebb017ae947		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF966 5236 bytes
font_01_sfnt_off00010b1b.bin
29da9c86b6999ca5815f12db49090b54dec39da85559b340a48340594c6f4149		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B1B 11320 bytes
font_02_sfnt_off0001319b.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1319B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.