Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b8f48a710e30173…

MALICIOUS

PDF

114.8 KB Created: 2021-05-01 15:36:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: f0543b3cac113f1fd6bd085b64e83ce2 SHA-1: 738f59ef9c738bceda7fb5b31b3ca9b60edc4cd2 SHA-256: 9b8f48a710e301734107bfe36ade5df6b540c15421c82b3a11147eee03cf7a65
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. One prominent URL, 'https://zajinet.ru/strik?utm_term=australian+childhood+obesity+statistics+2018', suggests a lure related to search engine optimization or phishing. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=australian+childhood+obesity+statistics+2018 PDF link annotation
    • https://lumixiwutetus.weebly.com/uploads/1/3/4/3/134388296/8298102.pdfIn PDF document text
    • https://ranenowubugipo.weebly.com/uploads/1/3/4/0/134040983/tususujo_makum_kojizoruw.pdfIn PDF document text
    • https://kapokifi.weebly.com/uploads/1/3/4/5/134510442/8d25d219a32.pdfIn PDF document text
    • https://getifejijepe.weebly.com/uploads/1/3/0/7/130739552/5a232b76ec.pdfIn PDF document text
    • https://muduvikude.weebly.com/uploads/1/3/4/4/134483108/vavoseneso.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/janodojivi/chemdraw_ultra_mac_free.pdfIn PDF document text
    • https://s3.amazonaws.com/vifusupegiza/ferotonumawasak.pdfIn PDF document text
    • https://s3.amazonaws.com/vavejijitatofu/88745494485.pdfIn PDF document text
    • https://291e86d0-b4b7-455e-aeca-30cd05102b29.filesusr.com/ugd/384a46_af151e7c1a9647bcae5ab3b1ea3adbd7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dae9dee2-aa97-4a34-b036-1e7bc5bf9898/birowepel.pdfIn PDF document text
    • https://s3.amazonaws.com/muxegeza/is_the_show_fresh_off_the_boat_cancelled.pdfIn PDF document text
    • https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_901872c1ab744fb6bb5babd041956f31.pdf?index=trueIn PDF document text
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_32b4d554708a48349b11b47e6b60973d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jupevuxirapi/bioconjugate_chemistry_book.pdfIn PDF document text
    • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_1eaab0fd02f64b24b278f7fe5ea13b1d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/86a83d25-17b6-4e89-9c19-cb4340cf74f6/31006869915.pdfIn PDF document text
    • https://0eaabcdb-938a-45a6-85a3-1a7d796bbcdd.filesusr.com/ugd/8d6d25_1092758316cd4240a2afe7c9a0b44de1.pdf?index=trueIn PDF document text
    • https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_11f5e5bd2f4848f18dc5ee9de76c7fe8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/loxopudizus/mechanics_of_materials_5th_edition_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015f55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F55 5660 bytes
SHA-256: b78859ff2352cb801cb3c9e3b19793938c3739190e4a35e89794c8cc9c356305
font_01_sfnt_off00017288.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17288 12104 bytes
SHA-256: 8e2c330c7b479489573da2abd6cd3dadf4c9df612ecd99eb8c95f4af9b009c15
font_02_sfnt_off00019a96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A96 16060 bytes
SHA-256: d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7
font_03_sfnt_off0001af2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF2E 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.