Malicious PDF — malware analysis report

Static analysis result for SHA-256 44ec252b68a9621c…

MALICIOUS

PDF

90.3 KB Created: 2021-04-08 04:01:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: ae9accbaa1cf896a5e149393b618b239 SHA-1: 76c9ebd3af74a9fbeb39bdcf4814b019a570bdd8 SHA-256: 44ec252b68a9621c2933d53228380baa2eecdde7f53c76b0d8db06b755d04046
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous external URIs, including one pointing to 'zajinet.ru', suggesting it functions as a link farm to distribute malicious content. The presence of a 'download button' heuristic further supports the lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=glencoe+biology+chapter+12+study+guide+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4469119/normal_6048f5a45fe2b.pdfIn PDF document text
    • http://jedusajinud.mygamesonline.org/dwarf_fortress_tutorial_kruggsmash.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415321/normal_6050bb3ef08c6.pdfIn PDF document text
    • http://piwulag.sportsontheweb.net/nokutogofevubomej.pdfIn PDF document text
    • http://gililofus.medianewsonline.com/baxaxomefo.pdfIn PDF document text
    • http://mezajozugabaso.getenjoyment.net/8849632132.pdfIn PDF document text
    • http://fupemagis.mywebcommunity.org/40592253800.pdfIn PDF document text
    • http://mugedly.xyz/zombieland_2_madison_returnstaj12.pdfIn PDF document text
    • http://gagogepatajebe.medianewsonline.com/57567768075.pdfIn PDF document text
    • http://stepka2016.xyz/pokemon_soulsilver_strategy_guideelw8v.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454543/normal_60651fd2e0dd1.pdfIn PDF document text
    • http://nuveclovet.xyz/20671846874sgb8q.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://d6d3a1c5-32ce-46e9-ae92-c5b8d84d65d9.filesusr.com/ugd/a3b54b_fedb52f03fac40e3931a93a0aa98d4c4.pdf?index=trueIn PDF document text
    • https://1ba6f066-89d4-4445-b8a9-08a6de046ef2.filesusr.com/ugd/d40554_f40d99ae0d1346f58660ba3cc9526903.pdf?index=trueIn PDF document text
    • https://1b6fbac1-9b66-4609-9151-81f5d4c316f7.filesusr.com/ugd/5e81b9_a681697ec5564d029668d413702c56bb.pdf?index=trueIn PDF document text
    • http://jabejanaboz.atwebpages.com/43321655587.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b6be216-ebf5-44c5-a654-3f4c3dbc8dd7/sevavomofivoma.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19dbee43-0b5b-48da-9545-d802894d1109/the_storyteller_jodi_picoult.pdfIn PDF document text
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_a2d796a39b7145be999591121ce09606.pdf?index=trueIn PDF document text
    • https://234a0c07-d908-4261-bb83-16b3c96a9b04.filesusr.com/ugd/73e0e6_036cc254f1eb4bdd975677b0af9c7b86.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebcf4f14-cc81-44bc-8290-19732d8790f2/zozorutaxiberil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a96ef4de-73d2-4607-bd22-eaa6ba51440a/pals_login_va.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ffd9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFD9 5884 bytes
SHA-256: 86eebd630c61584495879297ecd275204c849b5c4bc09004c03c07790281fd16
font_01_sfnt_off000113f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113F2 1812 bytes
SHA-256: 8b585ad00aee295104458879e8de05e2e08903e677111469ae8781a1061ff308
font_02_sfnt_off00011cce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CCE 11952 bytes
SHA-256: eef8f6c78bd5bc8da4de527ca748a10a55f3af3664f9bc0b69cfb5350708e5ef
font_03_sfnt_off000145c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x145C0 16120 bytes
SHA-256: b8fa99db91b4e2a38fb01ca4f8dfd1970d271bfdaf7323161a8b02e369b8fc98

Open this report in the interactive analyzer, or submit your own file for analysis.