Malicious PDF — malware analysis report

Static analysis result for SHA-256 41eec3ea621ddff1…

MALICIOUS

PDF

83.0 KB Created: 2021-05-29 16:02:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a7f6ab0be8bece51682c53c4d6cdb3ad SHA-1: 5a33a003f10e08c1221b910969b06b02d3fe3433 SHA-256: 41eec3ea621ddff1a7fb9b4de08ba6750f1bfe44b677436a586c70ee812d9ded
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with the primary URL being zajinet.ru, indicating a link farm or phishing lure. ClamAV and ML classifiers strongly indicate maliciousness, specifically a phishing trojan. While no scripts were directly extracted, the PDF structure and numerous external links suggest it's designed to redirect users to malicious sites, likely as part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=complementi+analisi+logica+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368748/normal_6031357717336.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374956/normal_606c60bacb2bb.pdfIn PDF document text
    • https://ninalekenapuboz.weebly.com/uploads/1/3/4/0/134017067/gidegowiput-dusegegiwuj-gezitivusatisa.pdfIn PDF document text
    • https://sujepofuk.weebly.com/uploads/1/3/0/7/130775011/xivufoba_jusigexiturel_vivatibavuvi_lusenu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458428/normal_600d98cfe273e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454041/normal_60620801064f2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421783/normal_605be7d8c12ab.pdfIn PDF document text
    • https://rujunile.weebly.com/uploads/1/3/2/7/132710621/ruxafisopimuluw.pdfIn PDF document text
    • https://lewebivaduxug.weebly.com/uploads/1/3/5/3/135392118/bakejif_xaris.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b84afc82-d36b-4e7e-a791-3ef4f56ec325/craftsman_12_belt_drive_band_saw-sander.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2637fe73-b4a8-488a-baff-e92e7d19be42/779674385.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d04e135-e8ec-4aa9-8f13-b8166b1632a9/alfabeto_ilustrado_colorido_para_imprimir_completo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca6b7ead-b0ac-4004-b303-470995932670/how_to_lean_a_cirrus_sr22.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/823ffa48-9d8d-4638-99e1-93e23266260d/78693727985.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14f122d6-79a6-47d4-b89e-fa1bf2118770/the_tyranny_of_merit_whats_become_of_the_common_good_book_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/500cc09f-dfae-4632-b720-687da08a9ad8/zowesukapapunowe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/776e268e-6cc6-4996-b994-4fc760e74b5c/vw_golf_4_service_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/479de010-46e9-44f7-8a19-176aafa71521/75399615724.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/037a18f0-a916-4d38-a026-2b2e03e0f752/context_clues_exercises.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1cdece71-6fb4-49a7-b603-5f1d219ab4f1/pokemon_adventure_red_silph_co_walkthrough.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7395da78-901e-4d2d-a0c3-fce3253efbc5/what_is_the_highest_level_of_nursing_care.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104BF 5284 bytes
SHA-256: 006b045b4c5734e1ffce65d82bbba2e88ce84502ba14530c4151938ffcb14b81
font_01_sfnt_off000116a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116A7 11700 bytes
SHA-256: 9e532b7988ee7e9171a0ce68d213e7320d93ae8bee2a803cd2a39d0b5e9971bd

Open this report in the interactive analyzer, or submit your own file for analysis.