Malicious PDF — malware analysis report

Static analysis result for SHA-256 80b2ab52f888ad8f…

MALICIOUS

PDF

88.2 KB Created: 2021-03-20 18:17:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2b98b1a7c8c155621fcc31010e1fa205 SHA-1: d451d3197d2041cf9e579d936982c354b4899e13 SHA-256: 80b2ab52f888ad8f7dab8cedfea02f86feb04d8dd18d40d5df8d37fe6a901535
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that directs to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly flagged this PDF as malicious. The embedded URL, 'https://jacksth.ru/strik?utm_term=kenmore+elite+dryer+lint+screen+replacement', is likely part of a phishing campaign or a distribution vector for further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=kenmore+elite+dryer+lint+screen+replacement
    • http://bestrongbyg.com/adobe_audition_trial_freehkm3v.pdf
    • http://kudretbozaci.com/91219922152aiy35.pdf
    • http://matras-24.ru/57443639082sb0rd.pdf
    • http://pululap.22web.org/tabe_practice_test.pdf
    • http://mmuuue.space/foloresewebivonupik50y6o.pdf
    • http://straponartist.com/paladin_character_sheet_5er9sdt.pdf
    • https://bepixumute.weebly.com/uploads/1/3/5/3/135302933/garexoxowikoseb-fuwol-wejopamumoxa.pdf
    • http://avtoshtorki.shop/girufirembd3a8.pdf
    • http://chestlune.online/navy_type_3_uniform_boot_regulationsno9b2.pdf
    • https://pijafajabivigin.weebly.com/uploads/1/3/4/6/134635516/rozexo.pdf
    • https://vuminuzatadabem.weebly.com/uploads/1/3/4/3/134311796/waduf.pdf
    • http://exemplpusj.com/indoor_water_parks_in_paris9n46y.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_8481b3fc881b41578e89b3f683b3daf9.pdf?index=true
    • https://s3.amazonaws.com/midizaxopazeji/zivalokesugunizajirotex.pdf
    • https://s3.amazonaws.com/zozuxukoxo/dynamite_piano_sheet_music_free_printable.pdf
    • http://nivutegem.epizy.com/dork_diaries_books_online.pdf
    • https://s3.amazonaws.com/moduluzuxikari/gagalewujam.pdf
    • https://a79fbd7c-12a6-44fe-9d3c-43dc2b0795a8.filesusr.com/ugd/f95141_661ba867d2b84ef08a4225b2f7c24323.pdf?index=true
    • https://s3.amazonaws.com/sewamos/fake_caller_id_apk.pdf
    • https://s3.amazonaws.com/kelageketisefuv/angular_templateref_in_service.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb59.bin
72f28a0aad285e1112af3057a1d0df9ab2779d89a7a61f763d37945ac6e23f82
pdf-font-stream PDF embedded font (sfnt) at offset 0xFB59 5288 bytes
font_01_sfnt_off00010d4b.bin
41a7c317713ce58402b641e40b89bb444ac8411179e181e29281bca450041edc
pdf-font-stream PDF embedded font (sfnt) at offset 0x10D4B 12084 bytes
font_02_sfnt_off00013625.bin
963f0c89af7281d4a3182780b6c5b5aff601a5d5aa41651a715097ad7274c37d
pdf-font-stream PDF embedded font (sfnt) at offset 0x13625 17820 bytes