Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e69e2df83e64a2c…

MALICIOUS

PDF

85.9 KB Created: 2021-02-18 09:08:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1705cc8928c8cbb1b2f92327be5dd903 SHA-1: 99df3767b7e5d6041f8f94226f396ef8c2d14ace SHA-256: 9e69e2df83e64a2cb04baf893ac41ceacf10acdbd4b7229e7b28899fba583b63
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, one of which, 'https://jacksth.ru/wix?keyword=zombie+frontier+sniper+cheat+apk', is directly associated with a heuristic firing for an external URI and a high ML classification score. The presence of a 'download button' heuristic further supports the phishing lure. The ClamAV detection confirms the malicious nature of the file, likely a phishing attempt to trick users into downloading malware disguised as a game cheat.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=zombie+frontier+sniper+cheat+apk
    • https://cdn.sqhk.co/nexetifosam/qRjbjij/cute_puppies_pictures_baby.pdf
    • http://1offpark.xyz/the_sociopath_next_door_downloadei07c.pdf
    • https://xogosafaxisomig.weebly.com/uploads/1/3/0/7/130739024/3cbfe0164.pdf
    • http://tibetterrier.ru/crown_cdi_1000_no_soundualgr.pdf
    • http://svarka-aurora.online/google_cricket_doodle7mpj4.pdf
    • https://static.s123-cdn-static.com/uploads/4495838/normal_6007f0df007d4.pdf
    • http://yyyyyyhhhhh.space/dadotorudikagenesifc26g5.pdf
    • https://cdn-cms.f-static.net/uploads/4488582/normal_5fd793fe09bdf.pdf
    • http://ontrade.top/mansfield_ma_police_reportsjwmup.pdf
    • https://cdn.sqhk.co/duxisabaza/geeHQzE/virus_news_today_uk.pdf
    • https://cdn.sqhk.co/bixatavafut/Krhe93s/vawarowavuditibutat.pdf
    • https://mizunemaki.weebly.com/uploads/1/3/4/8/134850414/lexafaxomep.pdf
    • https://lidovoji.weebly.com/uploads/1/3/4/3/134313359/cac06710.pdf
    • https://cdn.sqhk.co/webuzifinuno/vNhd38l/cyber_force_strike_shooting_games_3ds.pdf
    • https://static.s123-cdn-static.com/uploads/4409798/normal_5fce0061c0ce7.pdf
    • https://cdn-cms.f-static.net/uploads/4476596/normal_5fd95aa81f8e0.pdf
    • http://reduslim-official.website/litubemezawikisobitivixisgexz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rijaliwiguvex/english_textbook_evaluation.pdf
    • https://s3.amazonaws.com/ladojenefe/23097828938.pdf
    • https://s3.amazonaws.com/doxifuba/90656332297.pdf
    • https://s3.amazonaws.com/kudowo/adjectives_of_personality_worksheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1f5.bin
ea2be6eb89ab0d183412f8be2b49d14b97937311539abd67af8ccd1153281577		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F5 2900 bytes
font_01_sfnt_off0000fc50.bin
1762db2dd45fc41b2938af52dec17d3c98e16c02086c55e8734b94c9ad19f48e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC50 5384 bytes
font_02_sfnt_off00010e7e.bin
ba73c2f4633184d1fe1d8f353d810f0a3e14e78dff98bd2acd0ee4b0d65afd0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E7E 10608 bytes
font_03_sfnt_off00013313.bin
b21fd8cf88edbdd892e8e0e3ffa329b9673915048845ba443cf295f964d0ae78		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13313 16480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.