Malicious PDF — malware analysis report

Static analysis result for SHA-256 b500ff694210bdaa…

MALICIOUS

PDF

84.4 KB Created: 2021-03-15 14:00:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 75eaefc7a8413aee9253b4d285bfb8fc SHA-1: cc7eb46f10f53120935d92293b1819562c4b7d1d SHA-256: b500ff694210bdaaf54cbb9e7d0054efe931938a7a778fece53122d6b04d82dc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'zajinet.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'machine learning engineer' roles, aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=what+machine+learning+engineer+do PDF link annotation
    • http://pshcomonhere.xyz/basic_security_testing_with_kali_linux_30m8tk.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444114/normal_5fc8ce5449b72.pdfIn PDF document text
    • http://fezivexem.iblogger.org/perforated_sheet_machine_manufacturers_in_delhi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411219/normal_5ff6589c2a7f8.pdfIn PDF document text
    • http://bezufosaga.iblogger.org/fonibovixese.pdfIn PDF document text
    • http://evilcheats.fun/articulos_de_la_constitucion_mexicana_que_hablan_del_medio_ambientewm3ui.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384835/normal_600de01c9829e.pdfIn PDF document text
    • https://cdn.sqhk.co/zarejesorufo/vhaiij6/44839475437.pdfIn PDF document text
    • https://cdn.sqhk.co/tefozakozup/j7jagdC/93991463823.pdfIn PDF document text
    • http://stalekost.site/exercices_sur_les_prpositions_de_lieu_en_franaisb9eqt.pdfIn PDF document text
    • http://cosmosqrab.online/download_headshot_2016_mp4gvgzp.pdfIn PDF document text
    • https://cdn.sqhk.co/lojibuwe/GX3pPgg/disable_folder_sync_windows_7.pdfIn PDF document text
    • https://cdn.sqhk.co/nesuxozajek/aLsGhbP/aces_of_the_luftwaffe_ps4_gameplay.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369512/normal_5ff25eb525e1a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/padosumifubobo/christmas_jazz_piano_fake_book.pdfIn PDF document text
    • https://s3.amazonaws.com/rozebofukixus/guzoluvusezowaxe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ce13d44-1245-47fd-be1f-c04a1a194e86/zinapafew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ba5df5f-8142-44d7-ad41-746ef6d60c76/xuxasakedojofi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/650ddc6f-c2a5-4e82-a32d-bc7f3d8250c1/what_exactly_is_a_callus.pdfIn PDF document text
    • http://vometavofol.epizy.com/bulbula_re_bulbula_mp4_video_song.pdfIn PDF document text
    • http://fapetaboxepug.rf.gd/nowir.pdfIn PDF document text
    • http://wulagaw.rf.gd/brother_pt-1280_tape.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f8e7f71-1c66-4d2c-b224-7b8256408eaa/how_to_clean_whirlpool_dishwasher_not_draining.pdfIn PDF document text
    • https://s3.amazonaws.com/futamo/6335414672.pdfIn PDF document text
    • https://s3.amazonaws.com/vavapekadoliti/shimano_di2_manual_shift_mode.pdfIn PDF document text
    • https://s3.amazonaws.com/sonutopexaramuf/the_crucible_act_1_quotes_and_explanations.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00179703-6edb-48e0-8a2a-43daebd06e40/indifference_point_calculation.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010cb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CB7 5188 bytes
SHA-256: 82c333f943d8d5658906c9c024b8e5ddb7fb750494eca30e5b215a0e64b2e932
font_01_sfnt_off00011e3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E3A 11148 bytes
SHA-256: bae644b8c16007ebc89d8af9e10c35a3d182c883e32c39a1fe2e05ad5aab4ad8

Open this report in the interactive analyzer, or submit your own file for analysis.