Malicious PDF — malware analysis report

Static analysis result for SHA-256 61c6244718a9c369…

MALICIOUS

PDF

72.7 KB Created: 2021-05-22 02:26:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 99d1cf52512dd4d9b657d09c5131332a SHA-1: 507de8652675c93d230c696888d6c77110110eda SHA-256: 61c6244718a9c3698d18f7c9e2dcd1b1204cf5298488d11fac2981bf70498742
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An external URI pointing to 'jacksth.ru' was extracted, suggesting a potential phishing or malware distribution attempt. The document body, though heavily obfuscated, contains text related to downloading a song, which serves as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=descargar+cancion+de+rochy+rd+rumba
    • https://static.s123-cdn-static.com/uploads/4372719/normal_6004e6c287bc4.pdf
    • https://cdn-cms.f-static.net/uploads/4470703/normal_5fe94a3154aef.pdf
    • https://cdn-cms.f-static.net/uploads/4410730/normal_6014f424962d6.pdf
    • https://cdn-cms.f-static.net/uploads/4451025/normal_605dda68e37ba.pdf
    • https://cdn-cms.f-static.net/uploads/4446036/normal_602c3bb54ccaa.pdf
    • https://static.s123-cdn-static.com/uploads/4460055/normal_5fe07e774ff9a.pdf
    • https://cdn-cms.f-static.net/uploads/4387036/normal_603f8728c4de6.pdf
    • https://static.s123-cdn-static.com/uploads/4486983/normal_5fff515d221d0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tixedujegibex/xovoxuzoselekuwabenux.pdf
    • https://s3.amazonaws.com/lekelepowo/nufobapuzanenaputewevozex.pdf
    • https://s3.amazonaws.com/goveruduzewoxu/car_mechanic_shops_hiring_near_me.pdf
    • https://s3.amazonaws.com/nonabafat/doncaster_free_press_court_report_today.pdf
    • https://s3.amazonaws.com/tarajix/sonuxem.pdf
    • https://uploads.strikinglycdn.com/files/2f7fd12b-9bcd-446e-be81-edce52887309/lotakome.pdf
    • https://s3.amazonaws.com/zetituri/what_to_do_when_samsung_tv_wont_connect_to_wifi.pdf
    • https://uploads.strikinglycdn.com/files/c41a2dae-f33f-4a67-aebf-2db3826f713f/hp_cp1215_toner_level.pdf
    • https://uploads.strikinglycdn.com/files/7c39bbc3-a580-4c93-a6da-8279c509d308/68382288122.pdf
    • https://s3.amazonaws.com/gotenukevepunin/81209362555.pdf
    • https://uploads.strikinglycdn.com/files/5fe80e33-fcc2-4749-9dd9-bf74046300fd/craftsman_v20_cordless_string_trimmer_manual.pdf
    • https://uploads.strikinglycdn.com/files/022825ae-c091-4ddf-a08e-173e88de33e8/25406075242.pdf
    • https://uploads.strikinglycdn.com/files/3d60b054-8229-4276-97ae-697bed3738a5/36061362331.pdf
    • https://uploads.strikinglycdn.com/files/1341c6ad-3b3c-4d4e-a3d0-ec619336e69b/lobepixotaxiwumogovi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd9f.bin
3b38da4f11646f58fb99ddb23cec9f09988489a88cd4362e212c515e56114eff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD9F 5564 bytes
font_01_sfnt_off0000f068.bin
64ed8729a7980b815c763ab8b056b0473f923bc9ac58e650bf6d113e5b6d4009		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF068 11040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.