Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b8f5cd0f3ea3d49…

MALICIOUS

PDF

76.6 KB Created: 2021-03-15 01:44:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 71893dd29ae7c824a2f449a33e119e7b SHA-1: 15035dcf7db66eb40352d4d7122c9e21881a79bd SHA-256: 7b8f5cd0f3ea3d4914d2daa5ae43c89529c9f8e766f804a2c7f06200230db25a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'zajinet.ru', suggesting a phishing or malicious redirection attempt. The document body, though heavily obfuscated, appears to be a lure related to educational material, consistent with a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=best+math+book+for+grade+3
    • https://static.s123-cdn-static.com/uploads/4368501/normal_5fe3c21873519.pdf
    • https://cdn-cms.f-static.net/uploads/4417664/normal_603be748423c5.pdf
    • https://cdn-cms.f-static.net/uploads/4453532/normal_5fe65e7c9001d.pdf
    • https://static.s123-cdn-static.com/uploads/4469630/normal_5ffb912532d70.pdf
    • https://cdn.sqhk.co/sukijubese/iijeezq/raririjaf.pdf
    • https://cdn-cms.f-static.net/uploads/4410976/normal_602a3ebab2caf.pdf
    • https://cdn.sqhk.co/nemuvefik/iihh2ia/terminator_dark_fate_2019.pdf
    • http://limevekobo.iblogger.org/vubozunosetenad.pdf
    • https://cdn.sqhk.co/bapulofuw/ghTxhgU/spot_it_splash_card_game.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jaxarafepemu.epizy.com/39949157267.pdf
    • https://s3.amazonaws.com/xutomoxu/wunibodavududaka.pdf
    • http://bodufusuviv.epizy.com/remember_how_they_made_you_feel_quote.pdf
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_c3be0e474856427b809589be77fc11dc.pdf?index=true
    • https://044e8d80-c429-4a1f-820d-9b443c65b389.filesusr.com/ugd/53c654_30e3d6f2d4e346d0b03aac935941bece.pdf?index=true
    • https://s3.amazonaws.com/davolazupivowi/83492059089.pdf
    • https://8c1dc56a-a131-4b43-acff-3635b9115217.filesusr.com/ugd/90423f_7bebc18d33b54d15a48a68966baec39c.pdf?index=true
    • https://s3.amazonaws.com/panokojol/cabal_online_leveling_guide_2017.pdf
    • https://s3.amazonaws.com/vovabagubajegeb/kosibigojevefagewutevafe.pdf
    • https://uploads.strikinglycdn.com/files/6d3bca00-f55d-4520-9712-4b42b2950a27/42509117654.pdf
    • https://uploads.strikinglycdn.com/files/47cef9a6-3455-4c5c-a0af-d650add9623a/volvo_penta_duo_prop_outdrive_parts_diagram.pdf
    • https://ba3a7bb5-edd2-4228-b29c-cf272df6a868.filesusr.com/ugd/bd1c09_043c76e5e5aa47efb56dca55c3906713.pdf?index=true
    • http://gusuwopopuwu.epizy.com/auto_electrical_training.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb89.bin
dc3ff7f8abd3103bfc19087b0e12b7f1142cbea8a8c3dc8ef4771f697f52d783		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB89 5704 bytes
font_01_sfnt_off0000fec8.bin
f50483aa340aa3012f60d3cafeb4df69b74ee08961d16fef38b1954a51fc5195		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEC8 11268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.