Malicious PDF — malware analysis report

Static analysis result for SHA-256 909091eafdae1742…

MALICIOUS

PDF

90.6 KB Created: 2021-03-24 12:14:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ea291e36e6023a3bedcf4e5701000230 SHA-1: 936ec88edbcf8244ec187eeff0143b57ba7fbc12 SHA-256: 909091eafdae17426533b51b89b4123affa3752a859c4ef31b34f280389eb47f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'zajinet.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=william+and+sly+2+pixies
    • http://salonvarna.com/what_causes_earths_magnetic_fieldnvfp2.pdf
    • http://naxaliref.iblogger.org/70406572402.pdf
    • http://liketsven.xyz/karcher_pressure_washer_repair_kitul1f1.pdf
    • http://comp-arenda.site/130242729148e93i.pdf
    • http://muwazowezijowa.22web.org/challenger_850_performance.pdf
    • http://poverkavoda.website/wosazovotanujasavixededzemaq.pdf
    • http://raftgjgr.space/251471966537jhos.pdf
    • http://meetcabinets.xyz/481338310096f0ir.pdf
    • http://sluzhba1.net/amartya_sen_development_as_freedom_ebookh09zy.pdf
    • http://legalvictory.group/bakasana_information_in_marathioa42y.pdf
    • http://kemytbok.xyz/fesipxroxs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ae39247b-c96d-46d6-8238-b6c19d7c1636/street_law_textbook_free.pdf
    • http://wajabopekat.epizy.com/math_word_search.pdf
    • http://fewuzefar.rf.gd/5864001491.pdf
    • http://volitutaga.rf.gd/64718563534.pdf
    • https://uploads.strikinglycdn.com/files/d5b17ea5-b780-417a-ac60-ae7254953a2b/how_to_charge_portable_jump_starter.pdf
    • https://s3.amazonaws.com/fakuguvil/dukitole.pdf
    • http://kibuwigukakew.epizy.com/inverse_trigonometry_formula_class_12_solutions.pdf
    • https://s3.amazonaws.com/tazopaju/sword_art_online_alicization_character_song.pdf
    • http://gemixeferakin.rf.gd/miracle_box_crack_2._93.pdf
    • https://uploads.strikinglycdn.com/files/b9218c6c-e7e0-4887-bc45-7be1e7794467/what_are_the_main_characteristics_of_transcendentalism.pdf
    • http://mujunego.epizy.com/how_many_polar_bears_are_in_canada.pdf
    • https://uploads.strikinglycdn.com/files/07da5b47-9526-490a-8862-673e200870d5/idylis_air_purifier_model_ac-2123_filter.pdf
    • https://s3.amazonaws.com/tibanepoxilibud/89521351087.pdf
    • https://s3.amazonaws.com/wewiro/fronius_primo_5kw_datasheet.pdf
    • http://kibululugavi.epizy.com/cobb_breeder_management_guide.pdf
    • https://s3.amazonaws.com/pajeriramal/haryana_iti_allotment_letter.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001235f.bin
678baf034f656e0a43b498646a7dcffbf108e1e1973984a605da05d68857356a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1235F 5324 bytes
font_01_sfnt_off00013586.bin
457bce866a79f822e9773ff92f46dfc6d693cbe5bfc29e36c99241ac571af4c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13586 11364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.