Malicious PDF — malware analysis report

Static analysis result for SHA-256 412354df34979359…

MALICIOUS

PDF

75.5 KB Created: 2021-05-27 22:48:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 31c246adf170ee46dd2a84e60adcfdf1 SHA-1: 2a05ec62302700dc95f5deed066398fd4c366f9b SHA-256: 412354df34979359bf39348cf34f8213d17547bdd7a8e96e67a6f8405bef2e94
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged as malicious by a ClamAV detection and an ML classifier. It contains an embedded URI pointing to 'https://zajinet.ru/123?utm_term=a+template+strand', which is likely a phishing lure. The document body is heavily obfuscated, but the presence of the external URI and the high risk score indicate a phishing attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=a+template+strand PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4381095/normal_6043ef3d3666d.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4377128/normal_60aff1066b30d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496372/normal_6044944b03aae.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426270/normal_5fe12abfa3042.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448727/normal_6056ba2893bba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388173/normal_602dcbc10a91c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417024/normal_603c849050981.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4528260/normal_6056920f2d1fd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370985/normal_60539c03b1dd4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447647/normal_60618a07a58c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444095/normal_5fd84d26702e2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/489be594-d782-4bbd-a313-36a63e0e305b/wakajuzazukulafazovej.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ddf0f80-032c-402a-b561-62a1f8391ab9/how_to_change_vehicle_on_garmin_nuvi_1300.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c23af8a-b4c1-49a4-aac1-3b65cc687b25/how_much_does_a_prosecution_lawyer_make_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea1eeb17-c67a-47de-84e2-2b5fd80cdc53/53795132169.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8084cfa-c64b-4fe1-8214-7f322a6fe4ad/54368470595.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10a8e91d-a017-45d7-8565-e36344ac5ca7/powermax_45_plasma_cutter_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c6e3d09-2f0d-4aa7-96cf-81391f6f4c69/liwafukorinopetobigibuwiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9282b703-2efa-4588-9059-7833e13b5605/21546203984.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/740a7802-a847-4cf2-bb30-b928a4d2507d/2010_victory_cross_country_owners_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae973667-c7a5-4ff0-867a-f8bd5580167b/what_is_historical_criticism_in_literature.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c6b1734-08af-4b8c-9f3a-c0ce1a6f1764/dell_755_drivers_audio.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D5 5092 bytes
SHA-256: 9b8aca1fc1939dc1a442c3d0116db0cc4a35f07996a69e68e671d4c17ebc23ac
font_01_sfnt_off0000fa03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA03 11460 bytes
SHA-256: 9087bb69fad79127803146b905ef3cc09af94ee9b8721e7d577a98b7173d7a02

Open this report in the interactive analyzer, or submit your own file for analysis.