Malicious PDF — malware analysis report

Static analysis result for SHA-256 be91fd09aded9ebe…

MALICIOUS

PDF

85.8 KB Created: 2021-03-05 22:26:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb2213aeac4275781a885cc5f979d9e9 SHA-1: 9f8cabdd10834280b16736fdbe7e0d7a5818f93c SHA-256: be91fd09aded9ebec27051b98c4f41fbd326e76ef6158fd992034817ef148bf7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to infant skin conditions, likely intended to trick users into clicking the embedded malicious URL. This URL, 'https://jacksth.ru/strik?utm_term=porque+le+salen+granitos+en+la+cara+a+mi+bebe+de+1+mes', is the primary indicator of compromise, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=porque+le+salen+granitos+en+la+cara+a+mi+bebe+de+1+mes
    • http://copyrightnotices-form.com/dailymotion_mp4_converter_free_download7mov3.pdf
    • http://igcopyrightverify.com/how_many_hours_preparation_for_gmatc3hzk.pdf
    • http://my-favshopc.online/1560689635hyuq2.pdf
    • http://jukojadijomefar.medianewsonline.com/zutowixabosenezive.pdf
    • http://fuvesozufinefi.medianewsonline.com/50077564430.pdf
    • http://dimax.website/color_bump_3d_online_unblocked8h2by.pdf
    • http://a1metromovers.com/10972546768ov6af.pdf
    • http://mevukavotidu.getenjoyment.net/ketunetugo.pdf
    • http://najisemure.medianewsonline.com/pawofidubewawolufamefi.pdf
    • http://ragaliteres.iblogger.org/android_p_one_handed_mode.pdf
    • http://wusator.mygamesonline.org/what_is_glycolytic_system.pdf
    • http://hookup673.site/tribute_to_my_late_fatherb2ky1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/716bc2a0-aac5-4ca5-b4c7-b03cefe02e86/what_is_single_processor_system.pdf
    • https://uploads.strikinglycdn.com/files/c08b62cf-d386-4230-8165-c413880c6dcd/short_summary_of_percy_jackson_and_the_last_olympian.pdf
    • https://uploads.strikinglycdn.com/files/89f0979f-6af7-4599-be1d-c4fd2fcb2651/how_to_replace_battery_in_apc_ups_rs_600.pdf
    • https://uploads.strikinglycdn.com/files/1e7bf164-032d-42da-b402-cb2ab6b3782c/kingman_spyder_imagine_parts.pdf
    • https://uploads.strikinglycdn.com/files/12308c43-55c1-403d-b11e-04c589d6f488/danby_window_air_conditioner_8000_btu.pdf
    • https://uploads.strikinglycdn.com/files/a7e877a8-aa06-4b49-8a41-59f42a4ee674/how_does_the_us_government_response_to_the_great_depression.pdf
    • http://babudenipovux.rf.gd/miradubububobuvixiraw.pdf
    • http://pekesapawej.epizy.com/sijugunededabijikajudafa.pdf
    • https://uploads.strikinglycdn.com/files/193ca0af-df7e-4009-a723-405cd18a9535/44886472945.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e47.bin
0e546b44bb7a8797fb132dbe7d4cfe69ea85616bbfaf49ea8dfd5886bcbbcde2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E47 5576 bytes
font_01_sfnt_off0001211e.bin
2a3a29b2f82302d9632a1a9887aea061d5f4fe6c07f5b70bfe8e5cdc5ee2d1fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1211E 12032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.