Malicious PDF — malware analysis report

Static analysis result for SHA-256 eff6e465a729bbaa…

MALICIOUS

PDF

76.7 KB Created: 2021-03-20 19:09:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4b1410670477dbcbf207d98a1843f47 SHA-1: 406673b66272c381936cde4f2d7b40d48f3b659f SHA-256: eff6e465a729bbaa842d3f25b241f5c8540eb20cc90bc8275d973b2a631befe4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as a phishing trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains references to 'Die hard 3 imdb parents guide' and metadata indicating it was generated by wkhtmltopdf, suggesting a lure document. The primary IOC is an external URI pointing to 'jacksth.ru', likely intended to host a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=die+hard+3+imdb+parents+guide
    • https://cdn-cms.f-static.net/uploads/4485573/normal_6027e4b5387af.pdf
    • https://cdn.sqhk.co/vafegijateno/klaB20E/3_circle_venn_diagram_template_printable.pdf
    • https://cdn-cms.f-static.net/uploads/4461516/normal_603af50cd0665.pdf
    • https://cdn.sqhk.co/vipujitebiki/ZjhaCjf/mindware_elevator_marble_run_instructions.pdf
    • http://pofuxubilet.sportsontheweb.net/fazevubinas.pdf
    • https://cdn.sqhk.co/wenejusuzixe/dIjddij/48835550500.pdf
    • https://static.s123-cdn-static.com/uploads/4481280/normal_5ffb52c9d7924.pdf
    • http://tofoxewesaxizuz.mywebcommunity.org/xutakutolixaponesuwafafa.pdf
    • https://cdn.sqhk.co/zodunoxurob/5iiiajb/audio_mp3_cutter_mix_converter_and_ringtone_maker.pdf
    • https://zivotawab.weebly.com/uploads/1/3/4/5/134576919/galebo-mabalo-mukojapinifom.pdf
    • https://static.s123-cdn-static.com/uploads/4458125/normal_5ff45937ab5d0.pdf
    • https://cdn-cms.f-static.net/uploads/4374372/normal_602b2ada10e78.pdf
    • http://suxoxaxowigab.scienceontheweb.net/what_is_a_certificate_of_creditable_coverage_letter.pdf
    • http://refajunabewatog.iblogger.org/genie_blue_max_garage_door_opener_learn_button.pdf
    • https://rafexalubez.weebly.com/uploads/1/3/4/3/134311016/zifeludo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wikukodukoja.onlinewebshop.net/98334240339.pdf
    • https://4228e3e8-6e56-436b-9c2a-5710a6c3a216.filesusr.com/ugd/e32dc8_40bee517ca3c4133aaddcef379d5980c.pdf?index=true
    • https://625f08e2-3d8e-45b5-8e8c-b95d001c5c7c.filesusr.com/ugd/d94ae5_909a1569f6a845b49b1db78965389d38.pdf?index=true
    • http://pepajefosub.epizy.com/dalezesemarefuson.pdf
    • http://vudatuvabejosix.epizy.com/artioscad_7._6_free.pdf
    • https://cc4f1b1a-08c7-467e-bb5a-e3073ad8caf1.filesusr.com/ugd/ffc175_b2a1e054fa504fe2a8454ce7cabb2c89.pdf?index=true
    • http://bigapenegig.atwebpages.com/advanced_physics_cambridge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee66.bin
85924908bab87fce403ea4c1d5fe8f726e0023a374eea6fdd9959442bcfebf1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE66 5644 bytes
font_01_sfnt_off00010168.bin
f603c4c467ff84580c155d314fe0541327937e5182bda1ae77e6d70526c0c5c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10168 10740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.