Malicious PDF — malware analysis report

Static analysis result for SHA-256 72b3453908277006…

MALICIOUS

PDF

71.0 KB Created: 2021-03-23 10:25:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 061b91e89e5eb5876ed1ed720d81f239 SHA-1: 80fca335ccf27b653e6712993804faecf851e70d SHA-256: 72b3453908277006f1637bf0f27aa0aa311689e0d6050c12617bd049eeab4541
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://jacksth.ru/wix?keyword=mods+carros+brasileiros+gta+san+andreas+android', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to game mods, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=mods+carros+brasileiros+gta+san+andreas+android PDF link annotation
    • http://valezopifipob.22web.org/sagezi.pdfIn PDF document text
    • http://rawuzexo.iblogger.org/29480117000.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b11372b-094e-4016-b29a-63bc45a44376/degarmos_materials_and_processes_in_manufacturing_13th_edition_free.pdfIn PDF document text
    • https://s3.amazonaws.com/fadadedezeker/akreditasi_adalah.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83129ee4-7f40-4da2-afcc-f2510130efa7/what_is_the_best_diet_pills_to_take_to_lose_weight.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd468a41-6aa4-4ad2-a3e8-fc1c3cdbba61/vosofakavadokugo.pdfIn PDF document text
    • https://s3.amazonaws.com/jagux/gosulanujogufizo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38f7f432-e96c-44e4-970e-9afc779c2e61/lista_de_verbos_irregulares_en_ingles_en_todos_los_tiempos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1925b7c1-76a5-4b95-8675-117fb30660f8/rosemo.pdfIn PDF document text
    • https://s3.amazonaws.com/vexosafugunu/iphone_5c_price_in_uae_carrefour.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbd9fbdd-2f54-45e9-bb7d-0ed2948d268c/maytag_quiet_series_200_dryer_belt.pdfIn PDF document text
    • https://s3.amazonaws.com/tezude/easyclocking_miramar_fl.pdfIn PDF document text
    • https://s3.amazonaws.com/xakapudakadu/70484469548.pdfIn PDF document text
    • https://s3.amazonaws.com/rovuweraja/is_the_invisible_man_on_netflix_right_now.pdfIn PDF document text
    • http://podedubo.epizy.com/ortho_glass_splinting_videos.pdfIn PDF document text
    • https://s3.amazonaws.com/xukonakefules/50791269256.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c2dbbea-8f8b-4934-8cc6-db24bbcc7924/how_to_write_a_novella_properly.pdfIn PDF document text
    • https://s3.amazonaws.com/xesigeze/xozitajovoroguwunuvozaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5b95fb6-5eb4-4057-b6ce-801a0fa72156/pokemon_red_and_green_beta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebc273d2-c621-453f-a229-6561549dd621/16695289210.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6aa39156-c467-4d08-9cb9-c862e7c7cd56/how_to_redeem_pokemon_go_codes_ios.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d56a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD56A 5252 bytes
SHA-256: 77ac8b73d89634695b4c292959fc76a45beccedde0db616ec0e7ac0986bed2f7
font_01_sfnt_off0000e75f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE75F 11988 bytes
SHA-256: bbba510b204fefdd9efb44a581b16a5dd3ad41e15071542775c3a510ddc69ed1

Open this report in the interactive analyzer, or submit your own file for analysis.