Malicious PDF — malware analysis report

Static analysis result for SHA-256 7644c474219c1e9f…

MALICIOUS

PDF

77.0 KB Created: 2021-03-19 11:35:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ce6ef7e11c34a31b149630b6118e5dc SHA-1: 10b424665091b21e5dcae2d3661259bc957db3cf SHA-256: 7644c474219c1e9f8505675d68efd3efb999f582a04474137c81e6d8227dafb9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to a suspicious domain, 'jacksth.ru', which is likely part of a phishing or scam campaign. The document body, though heavily obfuscated, suggests a deceptive lure related to nature. No scripts were extracted, but the presence of external URIs and the overall detection profile indicate a malicious intent to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=what+are+the+colours+of+nature
    • https://cdn-cms.f-static.net/uploads/4413227/normal_6021a9f1ce3dc.pdf
    • http://detonic-romania.website/public_health_nutrition_michael_j_gibney9p5hc.pdf
    • https://fokomowopijav.weebly.com/uploads/1/3/4/6/134643156/9345425.pdf
    • https://begaraga.weebly.com/uploads/1/3/4/6/134652864/1536502.pdf
    • https://cdn.sqhk.co/filemowa/TSrzhen/ballot_template_excel.pdf
    • https://guvefivilemu.weebly.com/uploads/1/3/4/3/134397682/9759735.pdf
    • http://hisgohar.site/lean_manufacturing_classroom_exercisemr7mc.pdf
    • https://cdn-cms.f-static.net/uploads/4372681/normal_60245bfd81c33.pdf
    • http://liketime.fun/69874544445wgmn1.pdf
    • https://static.s123-cdn-static.com/uploads/4370074/normal_600398b1be3e3.pdf
    • https://cdn.sqhk.co/gujadozede/ieSy4dm/sipizejesujomap.pdf
    • http://perevod-card2card24.site/drifting_po_angielskuo8nqc.pdf
    • http://lighterusb24.site/can_i_listen_to_music_for_free_on_alexa3hhq2.pdf
    • https://cdn.sqhk.co/lopijikuvi/Tjcdftv/high_sea_saga_monster_evolution_guide.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/bakoloj/manjunatha_video_songs_free.pdf
    • https://s3.amazonaws.com/zagapaxa/denoxogewex.pdf
    • http://tapejufujol.epizy.com/10859071219.pdf
    • http://xawatutosewo.epizy.com/blind_typing_software_free.pdf
    • https://s3.amazonaws.com/rewepalazamiso/reporting_cohens_d_effect_size_apa_style.pdf
    • https://s3.amazonaws.com/jajuzasalikirut/bginfo_windows_server_2016.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e32a.bin
60567bb12259e07727140dab744db156f9fe89fc927fc73a52b272f5931ac7e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE32A 4816 bytes
font_01_sfnt_off0000f38a.bin
08e3dcf75d85f08fe16e0170f7d78b07692680a04b6ef97226d43242b8e0d37d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF38A 10716 bytes
font_02_sfnt_off00011839.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11839 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.