Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8690dad0b85ebcf…

MALICIOUS

PDF

105.4 KB Created: 2021-03-14 17:58:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 7e05d72e7cc8c541f658eda01b15323b SHA-1: c4356de1e6b18c0a3d118e3b9e4c18d703a3c067 SHA-256: d8690dad0b85ebcf1a0bc99fdb43d359fbc9fe34b894c30b2371ef9b94efac83
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, with heuristics indicating it contains an external URI and an SEO redirector link. The embedded URL 'https://jacksth.ru/wix?keyword=teo+torriatte+japanese' is the primary indicator of malicious activity, likely serving as a lure for a phishing campaign or to download a secondary payload. No scripts were extracted, but the PDF structure itself facilitated the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=teo+torriatte+japanese PDF link annotation
    • https://cdn.sqhk.co/pozigafo/hihrujd/33380464378.pdfIn PDF document text
    • https://cdn.sqhk.co/vumatoxikom/efCjjSA/61400611190.pdfIn PDF document text
    • https://cdn.sqhk.co/zitibidino/5RmXhhO/xalog.pdfIn PDF document text
    • https://cdn.sqhk.co/webunojixisa/hizthhF/lunetisumuri.pdfIn PDF document text
    • https://cdn.sqhk.co/tivuzofep/jghj4vp/first_aid_kit_supplies_refills.pdfIn PDF document text
    • https://cdn.sqhk.co/wepigosogo/bqhiNgh/the_wolf_among_us_season_2_cancelled.pdfIn PDF document text
    • https://cdn.sqhk.co/faxonudogot/kijjejd/4_immagini_1_parola_5_lettere_livello_61.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wolina/vekokixosefus.pdfIn PDF document text
    • https://s3.amazonaws.com/jotizifime/33370326136.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/what_does_the_bible_say_about_facing_your_giants.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c04be3b5-b2e3-4bda-b613-df360a6564ed/imax_b6ac_fake.pdfIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/21337054072.pdfIn PDF document text
    • https://s3.amazonaws.com/zalisujezajaje/inquisitor_40k.pdfIn PDF document text
    • https://s3.amazonaws.com/dogazisuze/how_to_create_dashboard_in_google_sheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a267837-31e3-4713-9184-0ee9c58b0f17/69325503146.pdfIn PDF document text
    • https://s3.amazonaws.com/mejigavukolu/dinigurafamove.pdfIn PDF document text
    • https://s3.amazonaws.com/kudowo/the_balanced_scorecard_kaplan_free.pdfIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/intimacy_movie_parents_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c255af5-9639-4925-80ce-b67c9fef0078/easy_writer_7th_edition_barnes_and_noble.pdfIn PDF document text
    • https://s3.amazonaws.com/puretulenuza/tidid.pdfIn PDF document text
    • https://s3.amazonaws.com/sogovekevi/retuzuluman.pdfIn PDF document text
    • https://s3.amazonaws.com/xuzed/zaxuxopekunotenoremiri.pdfIn PDF document text
    • https://s3.amazonaws.com/tarajix/competency_questions_examples_and_answers_police.pdfIn PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/61444698364.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113F5 11468 bytes
SHA-256: 7b9426f1bbda4d8349331291a5c6ecf4abf54669bc39fdea8171747d1e91bb53
font_01_sfnt_off00013a47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A47 4592 bytes
SHA-256: 0dca686e48a106b070b2e7860310b40aff6cb51f7fdb0158cc66723046b59ed4
font_02_sfnt_off000149e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149E4 12480 bytes
SHA-256: 1670932a494894b6930f40616db79674e8a7c90b19b8dd012ad210fbe7718cd1
font_03_sfnt_off0001736e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1736E 16348 bytes
SHA-256: 30c93438d3c92a080b58b57e4538b176c3c5fac83471d6c0b657682f04827280
font_04_sfnt_off00018958.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18958 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.