Malicious PDF — malware analysis report

Static analysis result for SHA-256 269a0c9d029f8b5d…

MALICIOUS

PDF

75.6 KB Created: 2021-03-22 03:57:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bf3d8e2bd65bc0e3ac8703b462d47507 SHA-1: 3a80ea0184ebba22529b7a12fdc8bc83c0509527 SHA-256: 269a0c9d029f8b5d7f8cc6c9444894e296f591b402824b87a73e70f16e7ed019
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm designed to direct users to various external sites. The primary malicious URL identified is zajinet.ru, which is presented as a search result for 'endgame amazon prime'. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=endgame+amazon+prime
    • https://cdn.sqhk.co/mubasetopagu/ggzhhAe/celebrity_solstice_cruise_ship_deck_plans.pdf
    • https://cdn.sqhk.co/difigobon/0F8ig0Y/hide._io_unblocked_games.pdf
    • https://cdn.sqhk.co/nezazexador/cgjrgg8/dead_zone_action_tps_mod.pdf
    • https://cdn.sqhk.co/letarezetap/jjgcjiX/bluestacks_hd_app_player.pdf
    • https://cdn.sqhk.co/fakineduxafe/dFEicgj/xfinity_xfi_app_android.pdf
    • https://cdn.sqhk.co/soxoxefumuv/dmjjNhd/loreker.pdf
    • https://cdn.sqhk.co/valujoper/iehagfN/score_hero_hack_2020_download.pdf
    • https://cdn.sqhk.co/vopofuxo/ieidgcm/uber_driver_login_1099.pdf
    • https://cdn.sqhk.co/xewafazuk/IjiSji0/soccer_world_cup_2018_silver_games.pdf
    • https://cdn.sqhk.co/nejibija/RFhdqLB/free_casino_games_slot_machine.pdf
    • https://cdn.sqhk.co/jarixizotib/dPuII1v/dragonvale_sandbox_quests.pdf
    • https://cdn.sqhk.co/bogulevim/qhjLijo/pin_pull_smoke_grenade.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_feabda3d449e4270836e8f0031cb89ca.pdf?index=true
    • https://uploads.strikinglycdn.com/files/35320e0b-b7d9-42cb-8230-ff6d9bbdeb1a/galapogexibel.pdf
    • https://uploads.strikinglycdn.com/files/18938654-9a08-4816-866a-5de5d1026160/plantronics_legend_5200_manual.pdf
    • https://50b44c92-959e-4a15-bf83-93d6b2b518d6.filesusr.com/ugd/3ed44c_687018fad15e4d7ca0ec092c8b0481ee.pdf?index=true
    • https://264cdfe8-48fc-440e-bff3-938583425051.filesusr.com/ugd/cd20dc_8c4f66af70544d748a108c0d4233b9af.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f52bdf65-4cf7-43f5-b38c-6fdb6c68dd7c/xovewerulovimegefolodul.pdf
    • https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_b5b4ec226d414430b79cf2173527b074.pdf?index=true
    • https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_f65fdbf68e9e4316a77482fac3183902.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7da01142-12a7-428c-b2bc-c1d9a321e57b/taco_bell_chicken_chalupa_supreme_nutrition.pdf
    • https://uploads.strikinglycdn.com/files/771657da-e9c4-4253-887f-645bdd5d23a2/63069226124.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dacb.bin
d541fd9c6b33e17402d00959f7d9426c0d6272c682a2b914243f99f7f82dc07b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDACB 4784 bytes
font_01_sfnt_off0000eaea.bin
5005f1c207c10e22c613ad83e2df50a86c46c6bff781db6d12ec063fa2b7e6ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAEA 11352 bytes
font_02_sfnt_off00011133.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11133 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.