Malicious PDF — malware analysis report

Static analysis result for SHA-256 b333bea5656e59dd…

MALICIOUS

PDF

70.4 KB Created: 2021-04-07 03:03:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7734257dd2aefd93b71123bd9a39b453 SHA-1: 443f2d0dae50d3a45f497f5f5522ca8594cdac24 SHA-256: b333bea5656e59ddcec46571fe0ddae9871d5eb661cf69113a481ba2b4128188
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious and likely phishing-related. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or SEO poisoning tactic. The primary malicious URL identified is https://zajinet.ru/award?keyword=fundamental+accounting+principles+22nd+pdf, which is likely used to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=fundamental+accounting+principles+22nd+pdf
    • https://cdn-cms.f-static.net/uploads/4455185/normal_603ea4c4f11f0.pdf
    • http://vuletotam.scienceontheweb.net/grammar_worksheets_for_high_school.pdf
    • http://nafigunagofadab.getenjoyment.net/mevumo.pdf
    • http://zedateve.mypressonline.com/96227485483.pdf
    • http://wedurorokim.mypressonline.com/fuxotubatemasasel.pdf
    • http://mizusowe.66ghz.com/xifonowuvifodozijal.pdf
    • https://static.s123-cdn-static.com/uploads/4496360/normal_5fcf8919808f9.pdf
    • https://cdn-cms.f-static.net/uploads/4451228/normal_6046741581956.pdf
    • http://vomamafawib.scienceontheweb.net/98113780550.pdf
    • http://jopagozopive.medianewsonline.com/what_is_unique_student_identifier.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_e4193667dc2c4e1a819039aedd69f6fc.pdf?index=true
    • https://62abf401-5fc9-4991-ac00-cb6a0c8cf8ec.filesusr.com/ugd/e4ff69_700a4764d2da4f0e9019b817a6d269ec.pdf?index=true
    • http://lipeporo.onlinewebshop.net/fibukukesa.pdf
    • https://6648aa49-deb3-4d6f-81a8-a63cc7a297fb.filesusr.com/ugd/38eac1_5aaed06ee881471593678fb202d96a24.pdf?index=true
    • https://8dfdba76-182f-4dc4-9dda-37a8c8d09dc9.filesusr.com/ugd/4ae4db_f6ba40f8ee2d408491625a9a2238c8da.pdf?index=true
    • https://d33b8dfc-9792-4d26-9d81-613d0bd32a71.filesusr.com/ugd/d34367_098b9454b3d64540aeae9ae7818c7d73.pdf?index=true
    • http://ramamezez.rf.gd/17372535836.pdf
    • https://dd3528e8-ded0-4753-843e-0d3cb9f542e7.filesusr.com/ugd/4d6844_6f5d776230694de88c780b924c92550b.pdf?index=true
    • https://704d67de-a0ba-412a-a77d-f8c4cf0d88a3.filesusr.com/ugd/a83d94_8bad7409a7d04618b422e05ef50f692a.pdf?index=true
    • https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_be9feba5a5644784816713c969528d8a.pdf?index=true
    • http://wodowepakimeko.onlinewebshop.net/judith_l.gersting_mathematical_structures_for_computer_science.pdf
    • https://dcc20dec-0195-4543-b617-cfb82efd15f0.filesusr.com/ugd/30ea26_9ac3e576b58f41599c92614620da33e0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6a2.bin
3c61388959420b678afeaae95d8487571471ef62d0df63864dd8790c589cdb1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6A2 5560 bytes
font_01_sfnt_off0000e97a.bin
d599016229e4349fbdcce02b1f1c80266383239527de1edc463244ebb76ab48b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE97A 10164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.