Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a92ae39e3155387…

MALICIOUS

PDF

221.8 KB Created: 2021-03-17 17:42:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cf2cf1c8692db26b55ea3886bb4b678a SHA-1: e05237034e31ed7a61e9689113f1e276a4eaa48e SHA-256: 9a92ae39e31553873b439668cc111020cc6addccafc6b6f64e72d09f5585c6bb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an external URI pointing to 'jottigo.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a 'list of states'. No scripts were extracted, but the presence of malicious URLs and the overall classification strongly suggest a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8712

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=list+of+states+in+alphabetical+order+pdf
    • http://dalkomis.website/runaxozojoguxedimafirapary3pla.pdf
    • http://xosubowavenu.mypressonline.com/sigutigevanewavimarezoxej.pdf
    • http://zumewidife.mygamesonline.org/what_religion_is_true_to_the_bible.pdf
    • http://fogafiv.mypressonline.com/xarivedetofa.pdf
    • http://bosemefawixuwov.mypressonline.com/79231857649.pdf
    • http://faceit.su/tipos_de_iluminacion_fotograficaj284v.pdf
    • http://gamowenugeg.sportsontheweb.net/breakfast_at_tiffany_s_truman_capote.pdf
    • http://nepoxiduvilej.scienceontheweb.net/21592029954.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xogijowag.onlinewebshop.net/othello_anticipation_guide.pdf
    • https://s3.amazonaws.com/wazorixekunafob/chagallu_weather_report_today.pdf
    • https://uploads.strikinglycdn.com/files/277e5547-e8e5-4a13-b7d1-c536e5fac2fa/29836500491.pdf
    • https://s3.amazonaws.com/bejeseja/english_literature_reader_class_10_answers.pdf
    • https://uploads.strikinglycdn.com/files/e73e3ea7-ca01-4ea1-870a-0cb1121f4434/keduvabetebigovenazijap.pdf
    • https://6acf0ca1-aa41-4771-8b91-54baff69ee7f.filesusr.com/ugd/7d1dc9_68cec8b97da14731b73889976df2d9b6.pdf?index=true
    • https://s3.amazonaws.com/xesigeze/i_cavalieri_dello_zodiaco_scan_ita.pdf
    • http://rogofideb.onlinewebshop.net/lezodolejodutamuz.pdf
    • https://36535336-4f9e-4c0a-b1ad-3385cb5d4299.filesusr.com/ugd/15ebe2_9d514d7f974c4691950ea768645215a8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d51e2350-6c52-4b6d-82b9-6ab3c319262e/network_security_basics.pdf
    • https://uploads.strikinglycdn.com/files/8f24b703-d7e4-40b4-96ec-7907b2ee1fa0/pipor.pdf
    • http://suxudogakol.myartsonline.com/xuguja.pdf
    • http://sutexuvidag.myartsonline.com/budismo_moderno_vol_3.pdf
    • https://7d6e376e-1ee3-4df5-88c1-8d1511d419f8.filesusr.com/ugd/7dd30d_63903f1551ac4b83bc5afa6e3469bf10.pdf?index=true
    • https://6d23287f-a15b-43b7-8d69-700c0e01f504.filesusr.com/ugd/185c00_2565ae5f4df0408bbdd5c279a7dfafad.pdf?index=true
    • https://s3.amazonaws.com/remeranexe/algebra_worksheets_for_grade_8.pdf
    • https://uploads.strikinglycdn.com/files/eac9b486-0218-403e-abac-8cf355ec0551/vudugilatewefijagimujag.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002de2b.bin
bbc9e0ea2f026596e68121cdd1292500d8d0e3e21da08daecd8e231c7bd95dc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DE2B 16588 bytes
font_01_sfnt_off0003129d.bin
5f4a0dfd5133ea3d056ba5b3a99327e07c5bf5f6da5258aabd879b4c5ed9bd08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3129D 5324 bytes
font_02_sfnt_off000324aa.bin
88b88cc51bc2ad48f39530b7ac4ecf48e0f595861f15ed9eacf2c050e8714256		 pdf-font-stream PDF embedded font (sfnt) at offset 0x324AA 14252 bytes
font_03_sfnt_off0003521b.bin
53121803cd1d13b4da54a9096520bf0c12ca821c8a17e323157945f8e58bee23		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3521B 16108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.