Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7a3ac7e298f1e15…

MALICIOUS

PDF

44.9 KB Created: 2021-04-06 14:49:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: deb58f0321bb62e39a8968a5c1d673b0 SHA-1: 8adf7117c1721ab101cba03a444267230058235d SHA-256: c7a3ac7e298f1e15d93a45e6e529f21de302ed257658f0e0cc47662ee39b2e2d
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical of phishing campaigns, with a high ML classification and ClamAV detection. It contains an embedded URI pointing to 'jacksth.ru', which is likely the next stage of the attack. The document's structure and the presence of a clickable link strongly suggest a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7951

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 44 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=printing+company+profile+template+pdf
    • https://zanugikujo.weebly.com/uploads/1/3/4/3/134399251/d9c182a62987.pdf
    • https://noragunefide.weebly.com/uploads/1/3/1/6/131637841/786552.pdf
    • http://vefaporuzudu.iblogger.org/27798296293.pdf
    • https://tekeginisexufu.weebly.com/uploads/1/3/1/3/131381150/f2333b1a351d46.pdf
    • https://static.s123-cdn-static.com/uploads/4410962/normal_60036f2116a05.pdf
    • https://lutapojedexom.weebly.com/uploads/1/3/4/7/134747239/sosunoxupat-vagidaneb-bozokizaj-lutenusanoleku.pdf
    • https://tugadebijo.weebly.com/uploads/1/3/4/0/134042488/kukorepisoba_gevawonajurekab_jofiserogumu.pdf
    • https://cdn-cms.f-static.net/uploads/4459170/normal_6020bfdb0533c.pdf
    • https://radifepibonavu.weebly.com/uploads/1/3/2/7/132712096/15a87b8b2.pdf
    • https://static.s123-cdn-static.com/uploads/4496015/normal_60011995f17b5.pdf
    • https://pinosapop.weebly.com/uploads/1/3/4/1/134131344/lidap.pdf
    • https://cdn-cms.f-static.net/uploads/4374519/normal_60260ff1d1b08.pdf
    • https://static.s123-cdn-static.com/uploads/4482399/normal_5fcc20f045c40.pdf
    • https://s3.amazonaws.com/bupijila/32350246654.pdf
    • https://s3.amazonaws.com/zarelusipofox/exclusive_distributor_certificate_template.pdf
    • https://s3.amazonaws.com/lepefi/times_tables_chart_free_printable.pdf
    • https://s3.amazonaws.com/setigafat/sorcery_1_walkthrough.pdf
    • https://s3.amazonaws.com/zafirawit/call_aundi_hd_video.pdf
    • http://vukelas.rf.gd/62675459836.pdf
    • https://s3.amazonaws.com/moduluzuxikari/graduation_invitation_printable_templates_free.pdf
    • https://s3.amazonaws.com/mekonulegipero/jowubegatemiji.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.