Malicious PDF — malware analysis report

Static analysis result for SHA-256 26a99e1e326bcbbe…

MALICIOUS

PDF

65.8 KB Created: 2021-03-30 02:39:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e1b75bc3ded4e43854bc0ef15a11abb3 SHA-1: 7ab6dd67b5fe68bc76546f667a6791c0e152f074 SHA-256: 26a99e1e326bcbbec9d38370ec0f7762bc73a2d7048ad655969691e64a61c247
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan and an ML classifier indicating maliciousness. It contains a large number of external links, suggesting a link farm or redirection mechanism. The primary URL, zajinet.ru, is likely used to direct users to malicious content or phishing pages. No scripts were extracted, but the PDF structure and numerous external links strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=craigslist+fort+lauderdale+florida+free+stuff
    • https://cdn-cms.f-static.net/uploads/4384839/normal_6042fea91c9c2.pdf
    • https://cdn-cms.f-static.net/uploads/4471686/normal_602ede9052cdf.pdf
    • https://kutobuxuvesoga.weebly.com/uploads/1/3/0/7/130740510/fb3ec75.pdf
    • https://cdn-cms.f-static.net/uploads/4499300/normal_6032a3491803b.pdf
    • https://cdn-cms.f-static.net/uploads/4415739/normal_60489b301d139.pdf
    • https://cdn-cms.f-static.net/uploads/4450434/normal_605efba6782dd.pdf
    • https://static.s123-cdn-static.com/uploads/4369794/normal_5fe41bc885945.pdf
    • https://cdn-cms.f-static.net/uploads/4407733/normal_603567ea54e07.pdf
    • https://duvujisukodat.weebly.com/uploads/1/3/4/6/134674851/8706644.pdf
    • https://wemizufatevovig.weebly.com/uploads/1/3/4/8/134896488/momofonod.pdf
    • http://bettermoneytips.com/bissell_turboclean_powerbrush_pet_carpet_cleaner_reviewsiu7oc.pdf
    • https://cdn-cms.f-static.net/uploads/4367923/normal_6029abb5dbe62.pdf
    • https://xadadoroz.weebly.com/uploads/1/3/6/0/136024884/giwibuzux.pdf
    • https://xemavuvewo.weebly.com/uploads/1/3/5/3/135394060/73ddc32.pdf
    • http://megatorg.ru/40926386293mu3jx.pdf
    • https://static.s123-cdn-static.com/uploads/4426812/normal_5ff560e9098c3.pdf
    • http://wudazex.sportsontheweb.net/43499594724.pdf
    • https://cdn-cms.f-static.net/uploads/4502567/normal_60571684558f9.pdf
    • http://hookup157.online/bojack_horseman_season_1_episode_12_scripttyrqk.pdf
    • https://static.s123-cdn-static.com/uploads/4454161/normal_5ffab77f7a437.pdf
    • https://cdn-cms.f-static.net/uploads/4423443/normal_6018d64e8d847.pdf
    • https://cdn-cms.f-static.net/uploads/4443357/normal_600e75e85970a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dafukip.myartsonline.com/best_managed_wordpress_hosting_site.pdf
    • http://vorisenunajix.myartsonline.com/8386863526.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c75e.bin
ec98227a75b53e66d404c7714ea4989b1efd50d4d74ff1eb1da822f7d7ea5469		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC75E 4980 bytes
font_01_sfnt_off0000d855.bin
7f34c958634d3ff6a1afab561c9fe93eeb1fe72523a93ab2e335ec9149d68afd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD855 9132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.