Malicious PDF — malware analysis report

Static analysis result for SHA-256 201acc6716418974…

MALICIOUS

PDF

144.8 KB Created: 2021-03-16 11:35:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92bf56ad0f016b8e262abda1e5e7b5d0 SHA-1: 2950a3369bdba3e124e1d7989df6106f93a8da77 SHA-256: 201acc6716418974db7eaa03a089a80588721ca375592734c2346dffae1b462d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'jacksth.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into clicking on a link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=cedula+de+identidad+ecuador+pdf
    • https://cdn.sqhk.co/redupalulaxo/jgdlhbh/zobuxaro.pdf
    • http://zoguponuwuxoli.medianewsonline.com/cub_cadet_lt1050_deck_belt_keeps_coming_off.pdf
    • http://spindlndou.space/damijhsba6.pdf
    • https://cdn.sqhk.co/pakebisas/AidqVjg/aliexpress_super_deals.pdf
    • https://cdn.sqhk.co/pixazizaze/QgdGifN/36246375221.pdf
    • http://pixxel.life/624285665611649x.pdf
    • https://cdn.sqhk.co/pivugituxi/a4jfkNQ/xefowimozonafifevilatetef.pdf
    • http://tuvivukaroj.mygamesonline.org/75286260739.pdf
    • http://zuvixomajav.22web.org/89904042936.pdf
    • http://muzesumulel.getenjoyment.net/21538594233.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rimefuvax.epizy.com/act_values_worksheet_bullseye.pdf
    • https://s3.amazonaws.com/genukopapovixo/logo_quiz_ultimate_answers_level_7.pdf
    • https://s3.amazonaws.com/zukogi/android_file_transfer_windows_7_free.pdf
    • http://vilatelisoto.onlinewebshop.net/metal_forming_operations.pdf
    • https://s3.amazonaws.com/nigimul/7923874952.pdf
    • https://s3.amazonaws.com/firigugixujotov/zedetolarefojisop.pdf
    • https://s3.amazonaws.com/zafirawit/avicii_wake_me_up_video_song.pdf
    • http://zonafikepejese.onlinewebshop.net/dixopakixavelotameba.pdf
    • http://gaxilitexu.onlinewebshop.net/votimixisixa.pdf
    • http://betakudo.atwebpages.com/adenovirus_enterico.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00021ad2.bin
cdaa09d52eac4288e0ed827907f9c833721426625e36f017ef3f33e018bc9715
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x21AD2 17072 bytes
font_00_sfnt_off0001d375.bin
a59be4b01827af5a6cb453748b241bb7cdb3d0d26a4fee26f2802842d770b7c4
pdf-font-stream PDF embedded font (sfnt) at offset 0x1D375 4876 bytes
font_01_sfnt_off0001e415.bin
9644a092fa93b40af590e817d1006522a6ca79f9bb14d604dcbce3df1ff55236
pdf-font-stream PDF embedded font (sfnt) at offset 0x1E415 18284 bytes