Malicious PDF — malware analysis report

Static analysis result for SHA-256 52e61eaa3e1baf63…

MALICIOUS

PDF

85.5 KB Created: 2021-05-10 13:12:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63684256bf6cb8fbaecfaa0abfc2f8eb SHA-1: d0d736018366f3d5c98332b853b62b75ac6a4ddf SHA-256: 52e61eaa3e1baf63d393be46bdcebe8b965d884715916bc5cb5deca6c6ca86dc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'zajinet.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to 'dishwasher brackets', indicating a social engineering attempt to trick the user into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=how+to+install+ge+dishwasher+brackets
    • https://cdn.sqhk.co/zolokike/jqR8igR/94648581827.pdf
    • https://cdn.sqhk.co/denugesugumu/PW1usib/falling_down_michael_douglas_youtube.pdf
    • http://novubelugalij.medianewsonline.com/nijapofititab.pdf
    • https://static.s123-cdn-static.com/uploads/4387933/normal_5fcb22c26ce50.pdf
    • https://cdn-cms.f-static.net/uploads/4415754/normal_606d04a4304b4.pdf
    • https://cdn.sqhk.co/nanubebebot/27bicjh/6101292008.pdf
    • https://cdn.sqhk.co/monasomeb/du7idii/last_player_battleground_survival_game_download.pdf
    • https://cdn-cms.f-static.net/uploads/4498834/normal_602c98d7eb229.pdf
    • http://kapovulup.mywebcommunity.org/kujudiwoluxit.pdf
    • http://kogutojoveso.mywebcommunity.org/business_management_ib_oxford.pdf
    • http://larokamexi.sportsontheweb.net/dell_latitude_5300.pdf
    • http://vobajujabu.mywebcommunity.org/hebrew_alphabet_numbers.pdf
    • http://pejazadajenatew.getenjoyment.net/edit_online_free_no_email.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/4c104d95-9b60-4fb9-aac2-06a723451118/71562890640.pdf
    • https://uploads.strikinglycdn.com/files/e344b145-28e7-4080-919d-6f005c050a8a/53544256527.pdf
    • https://s3.amazonaws.com/dikobepibelun/83673753358.pdf
    • https://uploads.strikinglycdn.com/files/3b36a24d-3917-47db-8015-383d82fe7207/honeywell_vista_20p_codes.pdf
    • https://s3.amazonaws.com/kevava/drosophila_melanogaster_lab_report_usf.pdf
    • https://s3.amazonaws.com/mejobu/dolch_words_kindergarten_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/9ac990c2-d4a3-4ef7-8248-b93e43a0c04d/nofevofonepuwawavilifa.pdf
    • http://gixarewujedel.atwebpages.com/how_does_live_remote_proctoring_work.pdf
    • https://uploads.strikinglycdn.com/files/ac61e0a9-9e72-4c69-bc1b-d099f64aab41/31311438342.pdf
    • http://lumosaneja.onlinewebshop.net/razikazubibizexejemavof.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010296.bin
cfa9a43fe41f6a885c313fe44c6b34d255a3b55fb7b8f3c6cfae854075d4e164		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10296 5244 bytes
font_01_sfnt_off00011467.bin
1a10c5c5bb3e9a34781c8d15606a16c5fb896407373bbdf39afc1dbd5756c78e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11467 11132 bytes
font_02_sfnt_off000139f2.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x139F2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.