Malicious PDF — malware analysis report

Static analysis result for SHA-256 26dadd31706801a7…

MALICIOUS

PDF

132.8 KB Created: 2021-03-24 11:53:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c02c72d669edc84fae4e9aae3485ede2 SHA-1: 205a582420325e842d3e7b4828f430c672880f1c SHA-256: 26dadd31706801a7ccba8de65bcc1a48c9068d5cbf2b2ad038dd463ab9437849
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://zajinet.ru/wix?keyword=mcsa+guide+to+microsoft+sql+server+2012', which is likely a phishing lure. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect users to malicious sites, fitting the pattern of a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=mcsa+guide+to+microsoft+sql+server+2012
    • https://cdn-cms.f-static.net/uploads/4406806/normal_5fd621db0b154.pdf
    • https://cdn-cms.f-static.net/uploads/4475863/normal_6036e198ea03b.pdf
    • http://wurulef.22web.org/crash_bandicoot_2_ps4_trophy_guide.pdf
    • https://cdn-cms.f-static.net/uploads/4466135/normal_603a19eae8159.pdf
    • https://static.s123-cdn-static.com/uploads/4369663/normal_6006bd37562fb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zudozam.epizy.com/78957888799.pdf
    • http://kokozebe.rf.gd/can_breville_juicer_go_in_dishwasher.pdf
    • https://s3.amazonaws.com/xakusineba/59626545928.pdf
    • https://68420551-d949-41c4-975b-2ae86aa6d062.filesusr.com/ugd/09c3c7_2cc9d71424354eecb596286205d45743.pdf?index=true
    • https://s3.amazonaws.com/xipavir/app_netflix_per_tv_box_android.pdf
    • https://d70b1dc8-7d09-4148-9854-e6a7cae1b87b.filesusr.com/ugd/5899d5_f508c5cfba37424c804e599af1abb221.pdf?index=true
    • http://kuxiguzemafuj.rf.gd/2018_chargers_uniform_schedule.pdf
    • https://s3.amazonaws.com/rimejiguvif/arishfa_khan_image_hd.pdf
    • https://s3.amazonaws.com/vibuvomomuv/75841455941.pdf
    • https://uploads.strikinglycdn.com/files/68cc3442-5de1-4ce6-9de5-f1c5e98ba1df/learn_how_to_trade_forex_south_africa.pdf
    • https://uploads.strikinglycdn.com/files/6775c370-7a4d-429c-9e6e-6c5953cbf6ca/61253057963.pdf
    • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_cf4e34153ceb4c40a4b9556396c3db1c.pdf?index=true
    • https://551f0ad2-75d1-4009-b90b-2f3e3e20230b.filesusr.com/ugd/c2bf0a_71f65146281a4446b7d922238b2bbe33.pdf?index=true
    • http://kemibibej.rf.gd/html_full_codes.pdf
    • https://53860ffb-5975-4088-b838-5c82367c2827.filesusr.com/ugd/0d2908_5f2a56ac12b4467e8ed3da39fe8af0a8.pdf?index=true
    • https://b32521b7-32ca-447e-9967-d27d0dce683d.filesusr.com/ugd/800b88_3fb9e012717a4bb1b868305e8f432c5d.pdf?index=true
    • https://s3.amazonaws.com/wovisak/58617236578.pdf
    • https://680e7e7f-99bb-4309-8a01-ecc910dc7690.filesusr.com/ugd/717a42_df5c49cdfd364e93a28250bf7d478e9e.pdf?index=true
    • https://f8340159-69ce-4309-ac43-521e9a8475b4.filesusr.com/ugd/bc0b97_0be0d2a8b1a44cbabaf044d7f5e08f00.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5d5d7f97-2527-4f2e-b56a-5e228f707546/5257744996.pdf
    • https://b1e6e3cd-24a2-426a-8b7d-e8f4bd81915b.filesusr.com/ugd/83e584_4eb1842a5b934abba520ef534c6cd669.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001cc44.bin
ce2cac4f1cb3fd06142912691bd2bc2c0b5dd56bda3ba7bcbe350c48f653afa4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CC44 5860 bytes
font_01_sfnt_off0001e033.bin
c8cf05d12fa3b717b743902043f67e4186713880f0c096ee69a150272eccd7dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E033 10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.