Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c168f6df352326f…

MALICIOUS

PDF

77.9 KB Created: 2021-05-05 17:35:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f57928307844bdb4e643e17a1d11246 SHA-1: 2876aa87a671171a8126ae8d4ee97fba4da457e8 SHA-256: 0c168f6df352326ff34e15b0c47ff4195bd61e014f3b4f5e058b702f19d16381
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a link farm, with the primary URL being zajinet.ru. This behavior, combined with ClamAV detection and ML classification, strongly suggests a phishing or malicious content distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of malicious intent, likely to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=1981+honda+express+2+parts
    • https://vejamepune.weebly.com/uploads/1/3/0/7/130776484/9d56b0fcbf03fb6.pdf
    • https://cdn.sqhk.co/putuziboki/cxhhphi/fallout_shelter_online_website.pdf
    • https://cdn.sqhk.co/rijatazuga/hehiFic/ringtone_download_free_music_ringtones_islamic_ringtones.pdf
    • https://cdn-cms.f-static.net/uploads/4421611/normal_60170232ea3fc.pdf
    • https://batabokisusixil.weebly.com/uploads/1/3/4/6/134689132/wopaguraluzusonulus.pdf
    • https://woxukobu.weebly.com/uploads/1/3/4/3/134392577/mufagefanam.pdf
    • https://cdn-cms.f-static.net/uploads/4366306/normal_605f9e93156a7.pdf
    • https://cdn.sqhk.co/xuwadezab/jbgihSa/luzazefijifekiwerazuz.pdf
    • https://cdn.sqhk.co/zoluxoni/gdgegdb/how_do_you_record_live_shows_on_hulu.pdf
    • https://kodepukezaxa.weebly.com/uploads/1/3/4/6/134665187/xilubanezag_sololirefexet_busof_nufudobolal.pdf
    • https://matazesugol.weebly.com/uploads/1/3/4/7/134702103/jurekep.pdf
    • https://cdn.sqhk.co/fusaduxuw/ghgfhid/learn_spanish_with_movies_english_subtitles.pdf
    • https://cdn.sqhk.co/fupupusamun/hi4hggg/bms_full_form_in_english.pdf
    • https://cdn.sqhk.co/xatimonixu/IUfQ9id/lisije.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b5526579-b22d-45a0-8251-9885a72cf3eb.filesusr.com/ugd/0cd019_af04ab5793204bb19a4c7b0c27bb1d49.pdf?index=true
    • https://s3.amazonaws.com/tezofuretejom/pakistan_audio_songs.pdf
    • https://s3.amazonaws.com/regovadeje/insinkerator_66_price_nz.pdf
    • https://9480ebe7-8096-4165-94d5-b35dd525e9f4.filesusr.com/ugd/07b43d_6ed385824d6d407399ff2edf73815a13.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e475.bin
19fe6d3511270ee3ff4fbce704f5f4a9fb9182a4344e37e40a38d55828b07e20		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE475 3312 bytes
font_01_sfnt_off0000f056.bin
41cff3d5a6c6c1dfcaa44c96d6618c0ddf3c98603f7139a188c12e0b946244d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF056 5524 bytes
font_02_sfnt_off00010317.bin
57f7504dfd2c127766f8c5b6bc1a4f33557fa951c48d77d57bfad40317bb9d63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10317 11796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.