Malicious PDF — malware analysis report

Static analysis result for SHA-256 c804a55e2ce0d055…

MALICIOUS

PDF

89.0 KB Created: 2021-03-26 06:44:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 487bc03398f2872dca57fbc39222cd1a SHA-1: 771a7b6f6ed950a9f27222272cc3da2bfa3b45a1 SHA-256: c804a55e2ce0d0555a4fedc6af348be9485ac0a785ad2f38f8a84177ac7dee5f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as a phishing trojan. Static analysis identified an embedded URI pointing to a suspicious domain, 'jacksth.ru', which is likely part of a phishing or scam campaign. The document body, though partially corrupted, contains text related to financial information, further supporting a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+to+find+dividends+per+share
    • https://static.s123-cdn-static.com/uploads/4403679/normal_5fc56d0daa5e4.pdf
    • https://cdn-cms.f-static.net/uploads/4367912/normal_6050e155c6fbf.pdf
    • https://static.s123-cdn-static.com/uploads/4421224/normal_5ffeb3c41e1b3.pdf
    • https://cdn-cms.f-static.net/uploads/4371020/normal_603b4ce09bd1f.pdf
    • https://cdn-cms.f-static.net/uploads/4464850/normal_602e7f1350d6e.pdf
    • https://cdn-cms.f-static.net/uploads/4445868/normal_60344fc537b24.pdf
    • https://cdn-cms.f-static.net/uploads/4413980/normal_6037b4dd62157.pdf
    • http://jogegeve.22web.org/vajagalumulefawewul.pdf
    • https://cdn-cms.f-static.net/uploads/4413242/normal_6052bda9c226d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/kosamupim/biodata_sample_in_word_format_for_marriage.pdf
    • https://s3.amazonaws.com/sefiwegegagu/jamokasetuvomonopameke.pdf
    • https://s3.amazonaws.com/guvovigo/moment_format_to_utc_time.pdf
    • http://goterarok.rf.gd/android_alarmmanager_foreground_service.pdf
    • https://s3.amazonaws.com/juvuraguvutoxif/letter_e_handwriting_worksheet.pdf
    • https://s3.amazonaws.com/jezobasit/appulse_corp_annual_report.pdf
    • http://jutoxuriwiloja.epizy.com/ceftriaxona_im_bula.pdf
    • http://jiwigazuvix.rf.gd/45131088396.pdf
    • http://bazofigi.epizy.com/89100866154.pdf
    • https://s3.amazonaws.com/dazinibonofobi/burger_king_gutscheine_januar_2019.pdf
    • http://pazokidewuwi.rf.gd/dcfs_report_california.pdf
    • http://tunawibiga.rf.gd/game_catapult_king_apk.pdf
    • http://gaxufaxurawago.epizy.com/zazig.pdf
    • http://jumawudoped.rf.gd/aviation_english_expedite_level_4.pdf
    • http://novozozoto.epizy.com/ruxodumijedupexasil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001111e.bin
cea1908981682a9aa49cdbc3b228ff5b3f678cfe2e75e168b01139a5702c9316		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1111E 4996 bytes
font_01_sfnt_off00012226.bin
3198238ea6e42b932faba35c0b985903c66d743cb0ae840b3390dc9adc416efc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12226 11124 bytes
font_02_sfnt_off000147e0.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x147E0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.