Malicious PDF — malware analysis report

Static analysis result for SHA-256 f39de58103f49025…

MALICIOUS

PDF

76.3 KB Created: 2021-03-10 00:55:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 79310e10f243f5ace2100c022c420e2c SHA-1: b9f3ebd246dd2624580d5a2d7e4cbb0d9836a1aa SHA-256: f39de58103f4902591dade0db3800f2dd010adf7f003679c0623357f0ea221f3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to 'jacksth.ru', which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to educational material, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=series+and+parallel+circuits+worksheet+middle+school PDF link annotation
    • http://voiprormul.xyz/understanding_chess_tactics_martin_weteschnik_downloadct0mt.pdfIn PDF document text
    • http://copyrightviolationcenters.com/chocapic13_toaster_edition_1._14._4iz3s9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388183/normal_5fe6033d6333e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367622/normal_5fe14253259e6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374013/normal_5fdd76a526666.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467945/normal_6031d4021d0cf.pdfIn PDF document text
    • http://xapakemulu.22web.org/3d_audio_songs_dj.pdfIn PDF document text
    • http://demask.space/the_metamorphosis_of_prime_intellect2tjbz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403936/normal_60119da99eac4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4458394/normal_5fdd1b3eeaa30.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451563/normal_6004af2566b1b.pdfIn PDF document text
    • http://lassituda.online/goodnight_moon_lyrics_go_radioxakhe.pdfIn PDF document text
    • http://mumolazesinidix.getenjoyment.net/radiwotewulunokowomoxo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470960/normal_5fccda3d537d8.pdfIn PDF document text
    • http://bawazofo.getenjoyment.net/all_the_bright_places_actress_name.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tolibewi.epizy.com/77456311284.pdfIn PDF document text
    • http://kowexefuwuron.rf.gd/free_medical_dictionary_for_android.pdfIn PDF document text
    • http://xivoxek.epizy.com/75261020186.pdfIn PDF document text
    • http://jasosuwer.epizy.com/69643326506.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC9F 5572 bytes
SHA-256: 6fe6f4ba00ed17c84a913d6a17e1339db293354a80ce88a52015db532618eef7
font_01_sfnt_off0000ff7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF7D 10416 bytes
SHA-256: 59d90f5dc555c2ae97af98065c0bb471abe331e3744e1ffd81033a6fb92224f8

Open this report in the interactive analyzer, or submit your own file for analysis.