PDF malware analysis — malicious · c837dc2e1fb58c53

MALICIOUS

PDF

83.4 KB Created: 2021-03-13 13:24:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ec788e886ce1157ae65ae3db3a93b28c SHA-1: 2a41f8d4777cbd4a2ddb756b65776ad1797bbc65 SHA-256: c837dc2e1fb58c53b82b2e710e9f258d5a4ca696a2b4d250d1ccc70d3e97e941

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URL pointing to 'jacksth.ru', which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, contains text related to 'Electrostatic review answers', suggesting a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/wix?keyword=electrostatic+review+answers
- https://cdn-cms.f-static.net/uploads/4420939/normal_60379cf70d688.pdf
- https://cdn.sqhk.co/dexediwiboze/RZiaifH/download_game_pokemon_tcg_online_apk.pdf
- https://cdn-cms.f-static.net/uploads/4420438/normal_6017d97350005.pdf
- http://tifusavegapawuf.mygamesonline.org/worlds_of_history_kevin_reilly.pdf
- http://tagaporigowekis.mygamesonline.org/jefavalikalovare.pdf
- http://lifolibi.sportsontheweb.net/madame_blavatsky_isis_unveiled.pdf
- http://pugisapi.mypressonline.com/fagifumigifironuf.pdf
- https://cdn-cms.f-static.net/uploads/4379034/normal_5fd6eef0a8485.pdf
- https://cdn.sqhk.co/vorebilifi/ieNhbue/sibefowul.pdf
- http://nopuvobetag.mygamesonline.org/18752402326.pdf
- https://cdn.sqhk.co/wuvupalib/igIh97C/january_2020_calendar_template_word.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/tokit/12342537238.pdf
- https://s3.amazonaws.com/xisefowu/rebebelilebuwu.pdf
- https://s3.amazonaws.com/kefodek/feravukim.pdf
- http://pozijawikubinun.myartsonline.com/attestation_sur_l_honneur.pdf
- https://s3.amazonaws.com/joterige/92068307551.pdf
- https://s3.amazonaws.com/satulibaren/attu_movie_tamilrockers._li.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eba9.bin` `065075f39b4f85f550908c4a21b17879aaa64a428dadc0252b539c10074b2d4f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEBA9	4900 bytes
`font_01_sfnt_off0000fc78.bin` `51d453efbe6932773450244aec791f2827b4b0ecad661c82e75735c03630fbb9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC78	14468 bytes
`font_02_sfnt_off00012b88.bin` `24c5c481937acf4f4841e6563a6d7a18cfdb810806c94b09ac0ff4033348c1e6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12B88	16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.