Malicious PDF — malware analysis report

Static analysis result for SHA-256 f499b5710fc3d758…

MALICIOUS

PDF

78.1 KB Created: 2021-03-31 15:05:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: f0fbe52e2a5ecf350526dec917190be2 SHA-1: e97e523cf1b42a2c66d2dc5ac85f3f1234f1b6db SHA-256: f499b5710fc3d758f0fce573e544229acac1388b057224e091ad2cbc52252fa9
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document is designed to trick users into believing they need a password for an archive, a common tactic to bypass gateway security. The presence of external URIs, such as https://jacksth.ru/award?keyword=300+logical+fallacies+pdf, indicates a potential download or redirection to a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=300+logical+fallacies+pdf PDF link annotation
    • http://nelezoroga.22web.org/add_and_subtract_integers_worksheet.pdfIn PDF document text
    • http://nokevaxexu.iblogger.org/dibivobadudib.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389353/normal_603455cb14ef5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490539/normal_605ee4f3b68dd.pdfIn PDF document text
    • http://rulavilev.iblogger.org/a_link_to_the_past_gba_guide.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/019ee0da-a279-44c7-8245-5f0b7a0e66e3/76570255340.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce282f48-719a-43c3-9652-6c07f6fc7a5b/61187031183.pdfIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/xinosesujijat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32356969-1ca4-4323-a4bb-68854be27118/43270113638.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f8882a9-325b-460a-9b08-039a73bed6d0/jefuruvutitorowegidagit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7461d0c-47c1-453c-ab1d-e9bc415cfb8e/what_is_the_most_common_hypersensitivity_reaction.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b2d2920-56f5-475a-8d1b-bbce503fb444/how_to_get_rid_of_acne_after_you_pop_it.pdfIn PDF document text
    • https://s3.amazonaws.com/tutapaxi/amadou_bamba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba639bcd-c1e9-40af-bc60-fa936a680d90/which_star_is_dimmer_than_the_sun.pdfIn PDF document text
    • https://s3.amazonaws.com/vavebufevodutob/69681701008.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/aarakshan_movie_video_song_in_hd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00bceadc-830c-4e12-9fa1-7e3146f7a044/sotulizulibidila.pdfIn PDF document text
    • https://s3.amazonaws.com/wudibirewuduto/vebamopujarobisevopud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a681360f-601e-43c8-bcd7-f30c54a4cb4d/70782607948.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3EB 5436 bytes
SHA-256: d3ec7ca2f9107a24641cc4903b791ff09df80490db9ef6c17ce53f11ea24184b
font_01_sfnt_off00010680.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10680 10896 bytes
SHA-256: 44aa40f32e2e1009a1c72377c58b6693ef4691f2d15eeb02ebbcb9c72a9f21dc

Open this report in the interactive analyzer, or submit your own file for analysis.