Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc3865f33a1dd7bd…

MALICIOUS

PDF

80.0 KB Created: 2021-03-09 08:30:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24a3f4e3ff9355882e4af05b777b841a SHA-1: aadefe1b7d99c85dcc7985cfc9627f98a21707d2 SHA-256: dc3865f33a1dd7bd159c93ebba6d084622cbd9903fe326e39e89df7d69a64304
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://jacksth.ru/wix?keyword=unblocked+donkey+kong+2', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, contains text related to 'unblocked donkey kong 2', suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=unblocked+donkey+kong+2
    • https://cdn-cms.f-static.net/uploads/4497685/normal_5fd61eb9bc123.pdf
    • https://cdn-cms.f-static.net/uploads/4473375/normal_5fdb884a9265e.pdf
    • https://cdn-cms.f-static.net/uploads/4530868/normal_5fd678a836ead.pdf
    • https://cdn-cms.f-static.net/uploads/4367919/normal_601a5054025d9.pdf
    • https://cdn-cms.f-static.net/uploads/4368770/normal_60243b388e5e6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ebcdcafc-278d-4249-ae85-4573ffc3cae3/kyocera_fs-3040_mfp_admin_password.pdf
    • https://uploads.strikinglycdn.com/files/ac0d5212-5091-4e6a-98c4-f1bb6689e6b9/likanup.pdf
    • https://s3.amazonaws.com/jubiferekaka/clock_timeline_template.pdf
    • https://uploads.strikinglycdn.com/files/1c5d7050-b36e-491e-b1fc-0bbbbb99a916/how_much_do_you_get_paid_an_hour_at_zaxbys.pdf
    • https://uploads.strikinglycdn.com/files/d87f37b7-6b61-4fe5-9dee-3d1ca22762f9/225748758.pdf
    • https://s3.amazonaws.com/jinabisura/leather_high_heel_platform_ankle_boots_zara.pdf
    • https://uploads.strikinglycdn.com/files/ad26171e-6ea5-4ebf-a7d0-b69196da46f5/jojijivinafurapalanopim.pdf
    • https://s3.amazonaws.com/dixaleko/28377469303.pdf
    • https://uploads.strikinglycdn.com/files/b7224cc1-b644-4309-917d-4bf531363dbf/rhetorical_strategies_in_i_have_a_dream_speech.pdf
    • https://uploads.strikinglycdn.com/files/e8102740-70b5-4437-91be-7bc33dc0f177/dan_brown_robert_langdon_books_order.pdf
    • https://uploads.strikinglycdn.com/files/c3996d95-c19e-46a8-9570-7bb23966be46/xatevuwevisukuzibavamofis.pdf
    • https://s3.amazonaws.com/kavalukato/bspp_thread_standard.pdf
    • https://s3.amazonaws.com/tirimofufemukat/google_agenda_partag_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efd5.bin
c423ecad60b2b76854b8fc979f8ffcb41e60f4ff5318eeb48131e46afea601c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFD5 3836 bytes
font_01_sfnt_off0000fd7c.bin
790d5aaef2ea7657a4e38ad890e84cef9149f8e887aefd07b8c85a5fda4167ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD7C 5052 bytes
font_02_sfnt_off00010ed2.bin
9f1100369354633d2fc7f6d3c4c0ef392d7232bff7f0ee3bf04584ea7a9d4dbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ED2 10492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.