Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd74877fad64ae2b…

MALICIOUS

PDF

77.6 KB Created: 2021-03-22 14:20:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f183e0f2019ef9cd2e3fbd03954006c0 SHA-1: 24995a13632eafadac2903706ed07f7eb9be0248 SHA-256: cd74877fad64ae2becbea7ec6bcd7d89bd4e4eb63ea5c612a7b8f0232ba92cec
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to writing a reaction paper, which is a common tactic for phishing or malware distribution. It embeds a URI pointing to a suspicious domain, 'jacksth.ru', likely intended to host a malicious payload or redirect to a phishing site. ClamAV detection confirms this as a phishing trojan, and the ML classifier strongly indicates maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+to+make+a+simple+reaction+paper
    • http://mizizufiku.mywebcommunity.org/wakazen.pdf
    • https://cdn.sqhk.co/mutuwatu/cy0gcij/goal_zero_flip_24_review.pdf
    • https://cdn.sqhk.co/rolaravez/hhahjgh/32025490208.pdf
    • https://cdn.sqhk.co/kigowabalo/gjH8jjG/lockheed_missiles_and_fire_control_locations.pdf
    • http://vugaganopofom.mypressonline.com/java_8_features.pdf
    • https://cdn.sqhk.co/neliwuwo/5Khajfg/52466728685.pdf
    • https://cdn.sqhk.co/rigizisojix/hjdaMhh/14836947755.pdf
    • https://static.s123-cdn-static.com/uploads/4403679/normal_5feb57ef25653.pdf
    • https://cdn.sqhk.co/mekurapiw/4gdDITK/stress_balls_bulk_price.pdf
    • https://cdn.sqhk.co/kixituvelil/ySgegf9/tavoxenogederusar.pdf
    • https://cdn-cms.f-static.net/uploads/4448542/normal_602b3d44d2ae4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lixuzo/86972518926.pdf
    • https://s3.amazonaws.com/makixibawumebol/javavu.pdf
    • https://s3.amazonaws.com/naxozelozude/97948441914.pdf
    • https://s3.amazonaws.com/memobofilenabon/97791101056.pdf
    • https://s3.amazonaws.com/mamibis/72086761263.pdf
    • https://s3.amazonaws.com/lakujusitejojet/75499898653.pdf
    • https://s3.amazonaws.com/pisedij/pobovurasukudumefelowi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f421.bin
5701e926f84d83522b8700a9a585d8ec37b3b23a21872ecf0f99e4163bb2627d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF421 5196 bytes
font_01_sfnt_off000105be.bin
dc74b2190e5d32cdbfb48ea48979e965ab0137da45b6b2d4a2f11d0c86e7c1e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105BE 10484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.