Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ce0eb62367d94cc…

MALICIOUS

PDF

70.2 KB Created: 2021-04-19 22:33:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d23da2b24293e71f96fec3d79a9d153 SHA-1: 78b48b646408a1ca0304a234f2403983b5cd356d SHA-256: 7ce0eb62367d94cc02760e6e66770d252b15d633b1a887edf2332d1088c02988
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'jacksth.ru', which is likely used to deliver a secondary payload or redirect to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a product manual, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=trena+bosch+glm+30+manual
    • http://dsv-trening.ru/example_of_problem_and_solution_text_type2da8c.pdf
    • http://foxuzopigudomin.22web.org/mawolojuxeminum.pdf
    • http://sifimomikev.sportsontheweb.net/academic_english_writing.pdf
    • http://gk-kuban.ru/can_i_use_synthetic_oil_in_my_honda_3000_generatorvgcyc.pdf
    • http://zanakodus.22web.org/gowonosu.pdf
    • http://tetizeniwa.mypressonline.com/adobe_reader_free_download_latest_version.pdf
    • http://jiviwizun.iblogger.org/73213463693.pdf
    • http://lorenbayi.com/mode_one_approach42pmg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/2e3e1114-2ca8-4366-991f-3cfd75ebf8f2/77345404303.pdf
    • https://uploads.strikinglycdn.com/files/70ecaf89-46cb-4def-b61d-8aaa25cc54f9/10372084803.pdf
    • https://uploads.strikinglycdn.com/files/b28ec8f6-93b4-4831-b719-be62a39a65f4/bidenatasafapafejefikub.pdf
    • https://uploads.strikinglycdn.com/files/aa3ecc1e-d8da-4d78-bb0a-a31bed254eea/85843169191.pdf
    • https://uploads.strikinglycdn.com/files/cbe8f6bb-ab8e-4429-97ca-124f0f7d2996/72102614378.pdf
    • https://uploads.strikinglycdn.com/files/e81051c4-81f7-4643-973b-90ecb4e0a766/9153696341.pdf
    • https://uploads.strikinglycdn.com/files/8dbfdee3-277c-4a6f-861a-c7f251e9837b/warhammer_40k_book_mega.pdf
    • http://safadixuzet.rf.gd/html_codes_list_with_examples.pdf
    • http://baxajuzurajuj.rf.gd/pc_bluetooth_free_software.pdf
    • https://uploads.strikinglycdn.com/files/fd67eb23-a1b1-4dbd-ae24-af092f470c0e/geralds_game_full_movie_free_download_in_hindi.pdf
    • http://wotawegij.rf.gd/vataf.pdf
    • https://uploads.strikinglycdn.com/files/42d3edb6-cade-4be7-a32f-3aa72b6964de/ice_cream_recipe_chocolate_no_eggs.pdf
    • http://gogositanisewu.rf.gd/2000_chevrolet_s10_owners_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c7f4.bin
08949b2dbf194863f8b3becc140450e357c59d77bb95e6673a6a590f685d7d25		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7F4 5364 bytes
font_01_sfnt_off0000d9f5.bin
dd504ea60c7cb599434c33511a389f5d2052aab7c958e5fbeca3eda44e2bc4ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD9F5 11148 bytes
font_02_sfnt_off0000fd9c.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD9C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.