Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c092d04abb7ceca…

MALICIOUS

PDF

98.6 KB Created: 2021-02-13 03:07:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 6b658a25f4b1f0820ab6ecf06d893963 SHA-1: eec58dbbf77999e8a6ad39556063066e9c8708dd SHA-256: 7c092d04abb7ceca28c1b85d98727993a857040c7c371fb727b65403abf17dd9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://jottigo.ru/123?utm_term=rachel+chandler+epstein+deutsch', which is a strong indicator of a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests a lure related to 'Rachel chandler epstein deutsch'. No scripts were extracted, but the presence of external URIs in PDFs often implies attempts to download further payloads or redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=rachel+chandler+epstein+deutsch PDF link annotation
    • https://cdn.sqhk.co/gukugifixija/iigh6jb/2020_olympics_skateboarding_team_australia_women_s.pdfIn PDF document text
    • https://cdn.sqhk.co/numiwufeguv/vNjcghT/special_warfare_training_group.pdfIn PDF document text
    • https://cdn.sqhk.co/sejejajoxej/gcC8CaL/fajumumoka.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382189/normal_5fd0eabeee1f4.pdfIn PDF document text
    • https://cdn.sqhk.co/xolafunodo/kKUhejl/bounce_house_for_sale_walmart.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4423188/normal_5fe13cf6b389b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404123/normal_6021843c46763.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418987/normal_5fd5fa6789d5b.pdfIn PDF document text
    • https://cdn.sqhk.co/ravuviwidi/ALzihhi/46254052869.pdfIn PDF document text
    • https://cdn.sqhk.co/febenapox/fDWxygh/sssniperwolf_videos_scary.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413231/normal_5fc8d76c144ac.pdfIn PDF document text
    • https://cdn.sqhk.co/zimuteraf/i1hisig/prison_escape_map_code.pdfIn PDF document text
    • http://getliterate.online/difidivunajonojivividi7b2sy.pdfIn PDF document text
    • https://cdn.sqhk.co/sixepatexup/4Fphath/zuvetenuz.pdfIn PDF document text
    • https://cdn.sqhk.co/kavonalitego/gdEciba/raruvawagavozegiwililim.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464303/normal_5fea20d21999c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407747/normal_6018b65dcfcff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000138b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138B6 2960 bytes
SHA-256: d8ef148c594adba1946aa7d95f188f3f33f69c77bc22762a1a4a57bcfd89a796
font_01_sfnt_off00014338.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14338 5168 bytes
SHA-256: 928f22aae2908deca610b06b756fcaf29fd3bdc340e07845895797c46243c53b
font_02_sfnt_off000154c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154C5 11892 bytes
SHA-256: c2b37ee00622d95ab996e75b82e7f257b23063aa88170bb201040020bb3dcbae

Open this report in the interactive analyzer, or submit your own file for analysis.