Malicious PDF — malware analysis report

Static analysis result for SHA-256 6299ce58b9a1a4d3…

MALICIOUS

PDF

76.9 KB Created: 2021-05-19 13:13:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 3e1403742e19c4fc6c105a2a2b261988 SHA-1: 2609c12f4caed273248418d5e79bf1f58510cf7c SHA-256: 6299ce58b9a1a4d3b624f9cd1b1cc6fb22094940f3fb14baf81b40595d9e0c25
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a primary malicious URL identified as zajinet.ru. The heuristic PDF_SEO_LINK_FARM indicates a large number of external links, suggesting a link farm or redirection scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or a scam, leveraging the COVID-19 theme to attract victims.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=cara+efektif+belajar+di+rumah+selama+covid-19 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4467285/normal_5fcd098431d76.pdfIn PDF document text
    • https://rudemituwidiv.weebly.com/uploads/1/3/4/5/134585289/nomas_bezeluzojal_bisabodesojabo_pesapu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489054/normal_600b1f3dac13e.pdfIn PDF document text
    • https://rimofunoduw.weebly.com/uploads/1/3/4/5/134525219/simuletipes.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443819/normal_5ff94b494a45f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470545/normal_602437087e657.pdfIn PDF document text
    • https://kixivoveluvib.weebly.com/uploads/1/3/0/7/130775150/zafezezawanus.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/35c292f7-8b7d-4623-9f98-635e0eb2a144/5_biggest_regrets_of_the_dying_book.pdfIn PDF document text
    • https://s3.amazonaws.com/gebukil/black_and_decker_lawn_mower_extension_cord.pdfIn PDF document text
    • https://s3.amazonaws.com/gotenukevepunin/guidelines_for_making_fruit_salad.pdfIn PDF document text
    • https://s3.amazonaws.com/sefipa/arduino_uno_r3_pinout_diagram.pdfIn PDF document text
    • https://s3.amazonaws.com/rubidokezive/application_for_correction_of_marksheet_in_university.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/97113414339.pdfIn PDF document text
    • https://s3.amazonaws.com/vosimalume/19598638708.pdfIn PDF document text
    • https://s3.amazonaws.com/viboxikuz/56510266753.pdfIn PDF document text
    • https://s3.amazonaws.com/kudefem/antioxidantes_no_enzimaticos.pdfIn PDF document text
    • https://s3.amazonaws.com/nijudow/gijozarefiberiwisepavus.pdfIn PDF document text
    • https://s3.amazonaws.com/sesijesule/12067234375.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fbc1c02-0c29-4e02-8476-c60a88fb5635/xabowixep.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE3F 5744 bytes
SHA-256: ae2a8f8f5f3f57fafa3973765f8696b6a8efb92b60a6853ddc541a5fb0ab1615
font_01_sfnt_off000101bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101BD 10780 bytes
SHA-256: 0f2e7a8209baeb512f5241e9d4f7064f69b80badc465f20508c0799adc8fedd1

Open this report in the interactive analyzer, or submit your own file for analysis.