Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c8b25fefbfcfb43…

MALICIOUS

PDF

75.4 KB Created: 2021-03-29 05:44:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f77f8591323c2567238750018a722be4 SHA-1: 76e07e80e9613589d8e24779d2fa33fa0c91a884 SHA-256: 4c8b25fefbfcfb434e5e832b02c563dfa0ad63b328c5cdd7d1cca81211cb76df
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'zajinet.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains text that appears to be a lure, attempting to direct the user to this external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=what+way+is+the+wind+blowing+at+wrigley
    • http://mebotus.mypressonline.com/learn_ancient_greek_language.pdf
    • http://xavimelobuvi.22web.org/rockstar_social_club_windows_8.pdf
    • http://prostosite.site/determination_of_flakiness_index_lab_report_discussion4r06g.pdf
    • http://kittyplay.online/pemaboladudujidite4fg14.pdf
    • http://wamuwosola.mygamesonline.org/functional_requirements_library_management_system_project.pdf
    • http://fumizudo.sportsontheweb.net/jebodozefiwiwoxul.pdf
    • http://sepukolobu.sportsontheweb.net/auditing_and_assurance_services_16th_edition_solutions_manual_free.pdf
    • http://optarfes.com/34412014747y0tkk.pdf
    • http://kmplitka.shop/kemper_profiling_amp_powerhead_set70d2u.pdf
    • http://sewonmedix.ru/ruxafutupqyzhj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sikuva/jiwegekajotegivezifaxege.pdf
    • https://s3.amazonaws.com/jojitagifuva/25545900009.pdf
    • https://2ea3657d-1c4c-40dd-8491-58aeeb8dc933.filesusr.com/ugd/18a85a_71e60129d6434ecbbe2aa855aa47a8af.pdf?index=true
    • https://5ccda086-29c7-4024-8a93-689df1f3b89c.filesusr.com/ugd/ed8107_ece85ef12300486fa7633167809d0b3b.pdf?index=true
    • http://kigagizotag.onlinewebshop.net/aprender_a_leer_electrocardiograma.pdf
    • https://ac4cd5cf-e861-4b1b-a585-e47049f737a6.filesusr.com/ugd/843280_4ce999a5b06b4faa9dc1cbcd86e07306.pdf?index=true
    • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_f6a0e9dd156546d18de0bfa08f48d44b.pdf?index=true
    • https://s3.amazonaws.com/fasudikek/pt_abm_investama_tbk_annual_report.pdf
    • http://dolipunifaz.epizy.com/52612099432.pdf
    • https://a6f18165-9bfd-46c9-8f51-0ab50cd0b687.filesusr.com/ugd/265c7a_eb7f39b6013a47c096a4c0fae985c891.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e925.bin
0770c398adbe39328de214e6a72cdf3bd138a63344822f1848c169de1b026196		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE925 5436 bytes
font_01_sfnt_off0000fbb4.bin
ba25f8eb3c45a627c163ddb1d677af00ad1c6e5eea6bc6d0262b24412492b9c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBB4 10772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.