Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0d9e94805aee58e…

MALICIOUS

PDF

87.9 KB Created: 2021-03-27 23:02:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 76b6c289fc902d03cce1240443f3e60c SHA-1: 43845e1812b6ae534f8305ed57362ff2e91b033d SHA-256: b0d9e94805aee58e65f1d52b81b4b8ba30fb035eb152a23403f6eb3f117607dc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, one of which, 'https://jacksth.ru/award?keyword=allahabad+newspaper+pdf', appears to be the primary lure. The document body, though heavily obfuscated, suggests a context of an award or important document to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=allahabad+newspaper+pdf
    • https://cdn.sqhk.co/feripamapuv/hcWAYwh/xuwowapodafajokarol.pdf
    • http://itdiscount.info/bifijojefaj64.pdf
    • http://sendgrid-de.com/76383962998u3pjw.pdf
    • https://cdn.sqhk.co/panafilaputu/ggTe4jb/deck_heroes_legacy_mod_apk_wendgames.pdf
    • https://cdn.sqhk.co/gaxokakijefe/af3pygc/hseni_accident_reporting.pdf
    • https://cdn.sqhk.co/noviraxat/c9ggggu/gujexazutokuliromasetuso.pdf
    • http://ekzo-fruit.ru/new_bp_guidelines_ukk1rig.pdf
    • https://cdn.sqhk.co/xawobovuji/cTuzhdJ/zenomobes.pdf
    • http://luminar4-download.xyz/a_contribution_to_the_empirics_of_economic_growthx6ekr.pdf
    • http://vajukadezazi.getenjoyment.net/operaciones_combinadas_con_fracciones_con_races_radicales_y_potencias_ejercicio_resuelto.pdf
    • https://cdn.sqhk.co/besiwowegin/iUhcgfW/license_plate_sticker_renewal_california_cost.pdf
    • https://cdn.sqhk.co/lotidonita/jfmhahg/farmville_2_country_escape_castle_of_dreams_event.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://wodowepakimeko.onlinewebshop.net/auschwitz_birkenau_guide_book.pdf
    • http://ziwebizivag.epizy.com/doxibufimewepaduxitedip.pdf
    • http://sebiwafexudezo.rf.gd/36578341368.pdf
    • http://luwawabegopit.rf.gd/36642744495.pdf
    • http://vidodusiv.epizy.com/xududi.pdf
    • http://nuzesadoz.rf.gd/51664046445.pdf
    • http://ponusiniwanus.epizy.com/60443252105.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d40d.bin
c13c32ce5daf38dfb957c75c6c43ceaaf38eefa46bd1109de072f0f43aa38559		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD40D 5352 bytes
font_01_sfnt_off0000e63b.bin
6539b129c5cd894636dc8f40f53a156c00c8f46378ab4f137c96d687a1cff6ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE63B 3720 bytes
font_02_sfnt_off0000f19e.bin
af3d1f3d43e5b82b525c29e90beceff070f4cb178f0b2e8d1a8c2a26fd2297aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF19E 10552 bytes
font_03_sfnt_off000115cb.bin
6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115CB 16164 bytes
font_04_sfnt_off00012b1d.bin
3b066912696f5d77a2ea6c4412fb3802892991bb93f4758b577e92bc82607b87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B1D 11816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.