Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1636a75cbd4db4f…

MALICIOUS

PDF

77.2 KB Created: 2021-03-13 21:15:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 10ba855ce20b2a2d75c18d5fb87ef4ed SHA-1: d71e17543f2c0b226416ae23a299bc78083917d0 SHA-256: b1636a75cbd4db4f2ceb537412840a191c16ca7e3f29b67e1fd91678a57d893c
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, and it contains an external URI pointing to 'zajinet.ru'. The 'SE_CALLBACK_LURE' heuristic indicates the document prompts the user to call a phone number, a common tactic in phishing and tech-support scams. While no scripts were explicitly extracted, the PDF format can embed JavaScript, which is often used to facilitate such lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=direct+marketing+pdf+journal
    • https://cdn-cms.f-static.net/uploads/4463034/normal_6026b995d1f32.pdf
    • https://cdn-cms.f-static.net/uploads/4367667/normal_60291fdbd02dc.pdf
    • http://amaryllis.space/velifatuwevisowufijogozighq6z.pdf
    • http://bcpreactiva-enlinea.com/16633654520g72w6.pdf
    • http://domainlimax.xyz/pals_provider_manual_ebooke0vsk.pdf
    • https://static.s123-cdn-static.com/uploads/4370768/normal_6003e7bd636da.pdf
    • https://cdn-cms.f-static.net/uploads/4370092/normal_5fe8545d7f7e9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/db498f09-e684-47d0-835b-9c298624604a/free_online_digital_photography_courses_uk.pdf
    • https://uploads.strikinglycdn.com/files/117fc234-e14c-49d7-9914-c0fd93cbe31f/administration_job_titles_list.pdf
    • https://uploads.strikinglycdn.com/files/85d8171c-9adc-44ea-8634-12f4d413b2d4/27939140565.pdf
    • https://uploads.strikinglycdn.com/files/e67f4289-66a9-49d2-8479-121a11026678/6603421909.pdf
    • https://uploads.strikinglycdn.com/files/d1aaf7f0-3dcb-4a1f-a7c3-73228a95c9d4/do_i_drink_too_much_alcohol_quiz.pdf
    • https://uploads.strikinglycdn.com/files/d747b8d2-e802-4686-a77c-9064ee28f266/how_much_is_a_2013_dodge_avenger_worth.pdf
    • https://uploads.strikinglycdn.com/files/bc3ee231-8d9e-4976-a70a-e54517401049/votumewofuzetogusamavaz.pdf
    • https://uploads.strikinglycdn.com/files/2106eb79-4ade-494b-b9cd-f0518ebf7a13/what_is_finger_joint_lumber.pdf
    • https://uploads.strikinglycdn.com/files/4d0f4e1f-7fe5-4984-988a-7a99ad0d46b9/zirivuvebudalumulumemut.pdf
    • https://uploads.strikinglycdn.com/files/380abc6e-0a22-4f30-8c36-41bc87c9dac2/summary_of_the_book_of_john_chapter_3.pdf
    • https://uploads.strikinglycdn.com/files/04ec38f7-8979-4bb1-921c-cb7a22f09d45/bigoxazowepimadegevivew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbd1.bin
aa4cc453859c756f3251e803a10fc5990897bd50caacf89436e80c7fb9080000		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBD1 5436 bytes
font_01_sfnt_off0000ee45.bin
d2557395b4dc6493fb4eed3d7e3be59f37259fb2e1609e3d8905296b415a0d3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE45 10712 bytes
font_02_sfnt_off00011313.bin
d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11313 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.