Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1bca9cdcadc136f…

MALICIOUS

PDF

85.4 KB Created: 2021-04-08 17:47:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55fcdc5b0aca6294e644606ebb6f5fba SHA-1: 7944ba79bf9ede9ed3a8e2bd984f1b5faf0241ba SHA-256: a1bca9cdcadc136ff2ed246994cc0d3efc752f96f0217bf33516e3891c9d2725
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'zajinet.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to be a lure related to HP laptop specifications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=hp+elitebook+8540p+full+specifications
    • http://tulinejifuwo.22web.org/learn_arabic_in_urdu_download.pdf
    • https://cdn-cms.f-static.net/uploads/4411228/normal_602b3e71d1c12.pdf
    • https://cdn-cms.f-static.net/uploads/4481841/normal_60384c3db3461.pdf
    • https://static.s123-cdn-static.com/uploads/4384461/normal_5fcbe9c87ec9c.pdf
    • https://cdn-cms.f-static.net/uploads/4418178/normal_6067e40428c83.pdf
    • https://cdn-cms.f-static.net/uploads/4372354/normal_604203c83ea09.pdf
    • http://wojifos.22web.org/pte_academic_exam_sample_essay_template.pdf
    • https://cdn-cms.f-static.net/uploads/4427293/normal_6019cdd16cfb0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xefejevife/langston_hughes_harlem_tone.pdf
    • https://uploads.strikinglycdn.com/files/ac010ea0-66e2-46c2-b61f-76bb7268e1fc/kotolopemitix.pdf
    • http://tovimemiluv.epizy.com/interview_questions_for_accountant.pdf
    • https://091a8774-b5bd-4fb7-8799-8d1ca0ca44ad.filesusr.com/ugd/8716ab_121c9adfd725430cb2f0c28dc0163922.pdf?index=true
    • http://defizal.epizy.com/litokikesedamisuti.pdf
    • http://ligizasin.rf.gd/workkeys_test_scores_bronze.pdf
    • https://uploads.strikinglycdn.com/files/d38a4eda-28f3-41b7-8588-ee10f27ead48/59837979254.pdf
    • https://3175e58c-9db9-4d87-bcb9-15e03531d93d.filesusr.com/ugd/c93210_2fda8d75093c4bda92b4365d92f710bc.pdf?index=true
    • https://cc968bdf-8a18-4a65-a72d-893c706ef441.filesusr.com/ugd/bae363_a6408cbe1dd0414a95fbb7f4bc534b8d.pdf?index=true
    • https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_7df2b96ee7a54537966ecd173f48c7b5.pdf?index=true
    • https://s3.amazonaws.com/kobivimelelo/vampire_the_masquerade_v5_advantages_and_flaws.pdf
    • https://uploads.strikinglycdn.com/files/424e26d5-6cde-4183-9301-efc258902341/smart_wristband_manual_book_version_1.0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001018d.bin
ddd743c046c47907b83db02ca025d8e9bde31ce97d7199dcae3a62cf5630f239		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1018D 5628 bytes
font_01_sfnt_off000114d2.bin
101bf02f14e82bfdc20a1da8a61621fee11ffd3de4d1ac0839bc312e2817d193		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114D2 17880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.