Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a7ea2d9c7b6a35f…

MALICIOUS

PDF

82.9 KB Created: 2021-03-28 08:26:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 187c090c15c248fd1e8d99f2601f8084 SHA-1: 543bfaef7d2e967ab01619f178f1491ff7928acc SHA-256: 9a7ea2d9c7b6a35fb47fa45798fc0c353d88a40bdf7e8602caa2c362c9a406ce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'zajinet.ru', which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=bissell+proheat+pet+carpet+cleaner+parts
    • https://cdn-cms.f-static.net/uploads/4383688/normal_605003547558e.pdf
    • https://cdn-cms.f-static.net/uploads/4455370/normal_6057b99df187b.pdf
    • https://cdn-cms.f-static.net/uploads/4501645/normal_604783e4f1d2f.pdf
    • https://cdn-cms.f-static.net/uploads/4420766/normal_6019b54c3a6fe.pdf
    • http://futajef.medianewsonline.com/roman_catholic_prayers_in_tamil.pdf
    • http://salestore.pro/7069458315rgy1a.pdf
    • https://cdn-cms.f-static.net/uploads/4472208/normal_603d420d7197f.pdf
    • https://cdn-cms.f-static.net/uploads/4454543/normal_604d105d3b2da.pdf
    • https://cdn-cms.f-static.net/uploads/4373776/normal_5fe8bdc2cdd03.pdf
    • https://cdn-cms.f-static.net/uploads/4482418/normal_603508467e8ab.pdf
    • https://static.s123-cdn-static.com/uploads/4489980/normal_600543cc672b4.pdf
    • https://cdn-cms.f-static.net/uploads/4450624/normal_6043fd1cb1cbe.pdf
    • https://static.s123-cdn-static.com/uploads/4371258/normal_5fdf658669c59.pdf
    • https://cdn-cms.f-static.net/uploads/4376621/normal_6055791650f17.pdf
    • http://iqecoportal.ru/loximufadigufezofa7rtwk.pdf
    • http://tesilav.sportsontheweb.net/daruxuxisar.pdf
    • https://cdn-cms.f-static.net/uploads/4421623/normal_604bbda1943a6.pdf
    • http://ouily.xyz/aplikasi_lagu_koreaqzbpm.pdf
    • https://static.s123-cdn-static.com/uploads/4404500/normal_5fc79cc92139f.pdf
    • https://cdn-cms.f-static.net/uploads/4475852/normal_6017b2a0aad76.pdf
    • http://lotto-investclub.com/is_the_bissell_crosswave_pet_pro_safe_for_hardwood_floors1cnd9.pdf
    • https://cdn-cms.f-static.net/uploads/4464327/normal_6026197ce7513.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bememikat.onlinewebshop.net/libro_el_mensajero_de_agartha_zombies.pdf
    • http://sekuwomexapa.myartsonline.com/18331959329.pdf
    • http://mizetum.onlinewebshop.net/24890948327.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9b3.bin
89f32f5be60c4e360bcf1273f7a89e5de04fd425dfe0c7e4b4f5418d5e69f546		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9B3 4856 bytes
font_01_sfnt_off00010a1a.bin
8e212129245a3a3f39624a771a10eac09828317d02b4bbfdccf4b79a8a072759		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A1A 11060 bytes
font_02_sfnt_off00012fef.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FEF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.