Malicious PDF — malware analysis report

Static analysis result for SHA-256 de5ac4dc3d84c2f7…

MALICIOUS

PDF

183.1 KB Created: 2021-04-05 08:26:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 637cb5f2e762421de30f95265b314a80 SHA-1: e951f3fbc60efed4770032c8b817c743f57d97ad SHA-256: de5ac4dc3d84c2f7eb070cb6bb04d7609625b78f778cdc42c8bf17b4ec4145ac
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document uses a lure of 'Tata docomo arbitration award pdf' to entice users. It contains numerous external URIs, with one specifically pointing to a suspicious domain ('jacksth.ru') that is likely part of a phishing or malware distribution campaign. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=tata+docomo+arbitration+award+pdf PDF link annotation
    • http://lukanovetefitef.22web.org/sample_email_for_sending_resume.pdfIn PDF document text
    • http://kodavuviguwu.mypressonline.com/fepepezu.pdfIn PDF document text
    • http://totipuzuforaz.mywebcommunity.org/booklet_maker_from.pdfIn PDF document text
    • http://gukiduwonaxinef.getenjoyment.net/sharepoint_2013_workflow_not_starting_when_item_is_created.pdfIn PDF document text
    • http://ukranews.site/8547904334i7mi5.pdfIn PDF document text
    • http://vegifeda.mypressonline.com/red_rising_book_series.pdfIn PDF document text
    • https://cdn.sqhk.co/guviterolovu/jarNhcd/37912656677.pdfIn PDF document text
    • http://pelistens.xyz/bavarirudrd4a.pdfIn PDF document text
    • https://cdn.sqhk.co/nadipozow/gzIKOif/bofixoluxuruf.pdfIn PDF document text
    • https://cdn.sqhk.co/jiluputumusi/jdjghay/kawadejijefititesuf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tutufot.rf.gd/perimeter_and_area_of_plane_figures_worksheets.pdfIn PDF document text
    • http://xasejumav.onlinewebshop.net/pufupopanarupesasol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f04b340f-c298-41d0-9556-73db801481f2/truncated_poisson_distribution_mean_and_variance.pdfIn PDF document text
    • http://kogejikez.epizy.com/wozosezogeva.pdfIn PDF document text
    • http://tuxizowivu.rf.gd/7993973059.pdfIn PDF document text
    • https://eee7329a-c4d5-4508-a8fd-a8ba515f7d9f.filesusr.com/ugd/5ed802_96516ffd67e64222876094c08f0a4ff7.pdf?index=trueIn PDF document text
    • http://wizebefekeb.epizy.com/8899845295.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/110a5a8f-e0e7-4f38-b290-365da6444374/dukuborap.pdfIn PDF document text
    • https://5e54d98c-4257-4cc7-9010-48f3df296eb2.filesusr.com/ugd/05240c_e1872d822d76415e8c2b3158f12c616d.pdf?index=trueIn PDF document text
    • https://677e6977-fc43-48b2-ac81-16e478c8573b.filesusr.com/ugd/3750c2_99fe89f21bc941eca43359339f755408.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/192ffe09-cb51-4642-bcbf-0ef88f7809e0/what_does_heavy_black_heart_emoji_mean.pdfIn PDF document text
    • https://d8ec88ce-93b1-4b83-b294-7016fd5b5063.filesusr.com/ugd/366252_a32f6c63157a4d3fa42dff8654933dda.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/60875c52-0317-41cc-a74b-f859e0b83065/75947691682.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000293e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x293E5 5272 bytes
SHA-256: b9e070817f4458107c40aa71ca984da08e529837b57d83df34f31594b5a4b38c
font_01_sfnt_off0002a5cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A5CB 11420 bytes
SHA-256: cfae8373359bb54d7e03775cf9fa694e6a74fe973dcb9463be067398cce5efc6

Open this report in the interactive analyzer, or submit your own file for analysis.