Malicious PDF — malware analysis report

Static analysis result for SHA-256 4df693061acd0296…

MALICIOUS

PDF

77.6 KB Created: 2021-04-04 13:16:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6d378930c5af8d422320d82cd88ca86 SHA-1: d52885f4ea74de444dcabc925568cb7035427e87 SHA-256: 4df693061acd02962e0a539b362f1e86759e67b866bfc2b6b46fb46992d1d69f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://jacksth.ru/wix?keyword=signal+simulator+rover+guide', which is likely a phishing or malware distribution lure. The document body is heavily obfuscated, but the presence of external URIs and the overall detection suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=signal+simulator+rover+guide
    • http://nawitebexu.medianewsonline.com/82617119443.pdf
    • https://cdn.sqhk.co/serodozire/Xicidgi/dynamons_world_evolution_chart.pdf
    • https://cdn.sqhk.co/kafexobesa/eyibjjp/world_rally_championship_ps2_cheats.pdf
    • https://cdn.sqhk.co/solijisivono/4Fija1h/jewonazorifojoju.pdf
    • http://nokiwurugibub.mypressonline.com/loxamuwasetifubonarob.pdf
    • https://cdn.sqhk.co/forokuxodel/RPZ9k4O/relarozezupane.pdf
    • https://cdn.sqhk.co/nujekezitifi/jahf5jc/bus_simulator_ultimate_pc_ye_nas_l_indirilir.pdf
    • https://cdn.sqhk.co/rorezina/i3iihEW/38529281786.pdf
    • https://cdn.sqhk.co/solaxutom/WjaB2Hh/final_fantasy_crystal_chronicles_remastered_switch_multiplayer.pdf
    • https://cdn.sqhk.co/fololekumi/ZJDria0/airbnb_customer_service_number_host.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6bd8341f-54e9-4c9a-abf4-bd78cea417a2/the_great_gatsby_study_guide_answers_chapter_3.pdf
    • https://uploads.strikinglycdn.com/files/200b310b-3196-4211-908e-db9b4ff363ff/jquery_tutorial_for_beginners_with_examples.pdf
    • https://uploads.strikinglycdn.com/files/ea8c3d7c-7f8c-4e9f-bb90-67f7f994aa52/is_zotero_safe_to_download.pdf
    • https://uploads.strikinglycdn.com/files/ec9001fb-f9e0-44d7-a35a-12d75bedb588/how_to_disassemble_keurig_for_cleaning.pdf
    • https://uploads.strikinglycdn.com/files/160a8075-4fe5-4a88-b2e4-a54e108ae845/how_to_make_a_15_hp_evinrude_faster.pdf
    • http://xumuritikoxuk.myartsonline.com/crack_ielts_in_a_flash_task_1_academic_writing.pdf
    • http://sagoralezerelo.onlinewebshop.net/ayushman_bharat_in_kannada.pdf
    • http://wojibikifi.myartsonline.com/81319129210.pdf
    • http://tebaputazaxuva.myartsonline.com/cisco_basics_of_networking.pdf
    • https://uploads.strikinglycdn.com/files/4ade82a5-0450-4568-9c32-04ca9dc9eb82/kokaladusaguwozutur.pdf
    • https://uploads.strikinglycdn.com/files/5c220b96-62dd-424c-93da-67cce41023e7/how_to_make_an_appointment_to_take_your_permit_test.pdf
    • https://uploads.strikinglycdn.com/files/cf2b95c5-be00-4b2d-a489-3e200e25b2c4/mesivojasakaxemejemono.pdf
    • http://lumosaneja.onlinewebshop.net/les_miserables_film_2019_synopsis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f32b.bin
e96c2a035fcb9b8941e662a830a9d5e118b24bab3f4b7e08baf7f5f2701f5f57		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF32B 5308 bytes
font_01_sfnt_off00010527.bin
7bc444f446b71abeecc454ea6d231d604ebb504277ebbd436ea572328d54e393		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10527 10444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.