Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a6e6662388a8c7e…

MALICIOUS

PDF

84.3 KB Created: 2021-03-14 23:05:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 920af730fb061c839f3d52753a8cd011 SHA-1: 17dce776bb4308161d91e5a51b0ec601568357ec SHA-256: 7a6e6662388a8c7e896693bce18f185c4a91c71c6f70123f800e70787a260354
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'jacksth.ru', which is likely a malicious domain used for phishing or distributing further malware. The document body, though heavily obfuscated, suggests a lure related to a 'Fluke t5-600 manual pdf'. No scripts were extracted, but the presence of an external URI in a malicious PDF strongly suggests an attempt to redirect the user to a compromised or malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=fluke+t5-600+manual+pdf
    • https://cdn.sqhk.co/lakodatoli/yjhHji9/dapelo.pdf
    • https://cdn.sqhk.co/fumodolanes/gfiijhd/radiant_church_kc_small_groups.pdf
    • https://cdn.sqhk.co/lajawawinu/ejfbFrI/ufc_fight_night_round_by_round.pdf
    • https://cdn-cms.f-static.net/uploads/4500692/normal_603d974eb44a9.pdf
    • https://cdn.sqhk.co/tibatojo/eeidgjv/reverso_classic_medium_thin_forum.pdf
    • https://cdn.sqhk.co/perikowep/jheFbhi/vapasalar.pdf
    • https://cdn.sqhk.co/pibepufas/ijajerw/xonukerumizoterezujid.pdf
    • https://cdn.sqhk.co/zoxinugokas/s4ihRw4/51532949500.pdf
    • https://cdn.sqhk.co/duxadikoti/jbJiif7/passion_red_color_car.pdf
    • https://cdn-cms.f-static.net/uploads/4412895/normal_604acfff200af.pdf
    • https://cdn-cms.f-static.net/uploads/4451363/normal_6014ecaf956ba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.thdl.org/http://www.thdl.org/Tibetan
    • https://s3.amazonaws.com/lorugipopuxe/current_weather_report_of_garhbeta.pdf
    • https://uploads.strikinglycdn.com/files/58237632-3f64-44ca-a7d4-f73058783e93/ccnp_routing_and_switching_quick_reference_free_download.pdf
    • https://s3.amazonaws.com/rizezobabub/arjun_reddy_movie_tamil_dubbed_free.pdf
    • https://s3.amazonaws.com/mefovu/xibamininomepababo.pdf
    • https://s3.amazonaws.com/setaxilitozuko/pumpkin_math_worksheets.pdf
    • https://s3.amazonaws.com/lixuzo/79733885285.pdf
    • https://uploads.strikinglycdn.com/files/0dcfa1d0-1601-4b82-933c-1064d37bd86d/15977163766.pdf
    • https://uploads.strikinglycdn.com/files/89d3ea5b-ea4d-48a2-a40f-728bb0e0cd3a/colours_of_wire_haired_dachshund.pdf
    • https://s3.amazonaws.com/vedexajawo/43774069146.pdf
    • https://s3.amazonaws.com/jukezeluf/kaxuwisu.pdf
    • https://uploads.strikinglycdn.com/files/4d96cc4b-b223-4c0b-a270-0d2cbc85d92b/91310423680.pdf
    • https://uploads.strikinglycdn.com/files/fcfb469d-85b3-4c2f-976c-37b6e1ee8e95/mulaxuzadekokavigujut.pdf
    • https://s3.amazonaws.com/banula/61661890680.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.htmlTibetan

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4aa.bin
b18046695c9fb83d7d10a1eeac95899b34ea93c4a700645f6f1beff1e79fd5e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4AA 5384 bytes
font_01_sfnt_off000106fe.bin
1e40410bc9dc1fc1cd39fdc8a7e47174f3455396372c5319cd43e75d78c0d0c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106FE 9148 bytes
font_02_sfnt_off00011956.bin
2d862b1879eb28fd6850037991b2f7fbe5f577b449339d6ed8d585176f97bba1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11956 11992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.