Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f6c7fc30e712e9e…

MALICIOUS

PDF

100.8 KB Created: 2021-03-18 23:01:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ea1bd23a8380ecc2b89c793a5897abdd SHA-1: 9a02c4522bfe5f34f4f10082254433a04273a9d3 SHA-256: 4f6c7fc30e712e9e99c0ba14c33d18c6a0079612f736761ca5776d16ce5df2c4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'zajinet.ru', which is likely a malicious domain used to host phishing content or download further payloads. The document body, though heavily obfuscated, suggests a lure related to academic search results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=functionalist+perspective+of+social+inequality+pdf
    • http://biwumani.mywebcommunity.org/2008_bmw_328xi_repair_manual.pdf
    • http://nepoxiduvilej.scienceontheweb.net/who_is_the_most_good_person_in_history.pdf
    • http://lifepax.iblogger.org/nufopubotavekovuvemusuka.pdf
    • http://pasevomufarezo.22web.org/akashic_records_english.pdf
    • https://cdn.sqhk.co/wejafivelij/ajgnpgj/49842834180.pdf
    • http://dajobod.getenjoyment.net/bozimemesomajidavilepaf.pdf
    • https://cdn.sqhk.co/difixoruze/wjb1hiM/55525077898.pdf
    • http://werikipirojenob.scienceontheweb.net/51145737937.pdf
    • http://roxelejabojafe.scienceontheweb.net/is_chevrolet_camaro_2010_a_good_car.pdf
    • http://lejunuzegakikuv.mypressonline.com/back_stretches_spanish.pdf
    • http://salepid.iblogger.org/maxtor_onetouch_3_driver.pdf
    • http://tarezirok.mypressonline.com/44857785651.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jivamubug/fitodi.pdf
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_ba1209f900b44a80804cbeded8b6034d.pdf?index=true
    • https://s3.amazonaws.com/wifiduxezo/didawimatejodamekifu.pdf
    • http://kavibajegis.onlinewebshop.net/axel_vervoordt_living_with_light.pdf
    • http://wegugoleta.onlinewebshop.net/walgreens_blood_pressure_machine_instructions.pdf
    • https://s3.amazonaws.com/nonabafat/25369674803.pdf
    • http://wotanuxofewaru.rf.gd/vugune.pdf
    • https://d7179dab-c972-4501-9f4a-16044ca71e84.filesusr.com/ugd/434f74_15732f8e03bb401c9cde15fe9b792bc5.pdf?index=true
    • https://s3.amazonaws.com/zoromexemuzid/pisarofawap.pdf
    • http://bolirazebaf.myartsonline.com/jeep_grand_cherokee_2014_problems_australia.pdf
    • https://s3.amazonaws.com/pululusodogi/ncert_maths_class_6_book.pdf
    • http://ferodokibaw.epizy.com/81898917787.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014d87.bin
33adb454d8d2eba281b5d1914cb53bbfc4f5accaf77698845a5c00798f2c771d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14D87 5392 bytes
font_01_sfnt_off00015fff.bin
2e7f8e591402cb271db0857b8e3e8db584dcbfc21f1cfef3e1012eeaff1f6e77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15FFF 10960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.