Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5cf3f71c275e0d9…

MALICIOUS

PDF

76.3 KB Created: 2021-04-07 18:30:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02731ad9a6e9f7815741960990cd7227 SHA-1: 137304e84f38cf3ab9d4c032e58780b1df3e2d00 SHA-256: b5cf3f71c275e0d9d78e61a7f7d8dc2387320256f8866175411bccb7821fc8c6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains an embedded URI pointing to 'zajinet.ru/strik', which is likely a phishing or malware distribution site. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to a malicious resource, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=encyclopedia+brown+boy+detective+activities
    • http://fruktovik.com/nasal_cavity_bones_mnemonicmvab9.pdf
    • http://beautysale.site/defulokoxufeguwitebupiwewc5p88.pdf
    • http://kwini-fini.online/zarubuzedizubumuxivuvenipu1fq0.pdf
    • http://boxosusig.22web.org/books_to_read_to_your_baby_online.pdf
    • http://zhenskiizhurnal.ru/86439493186fcxgz.pdf
    • http://phillipen.online/96157150666mjfhi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pajukovuxetu/quicken_2016_for_windows_update_and_mondo_patch.pdf
    • https://s3.amazonaws.com/luworizesupox/how_to_enter_code_for_ge_universal_remote.pdf
    • http://podixisuxusajez.rf.gd/area_of_triangle_formulas.pdf
    • https://80172413-d145-4b71-b7cf-4a007d76ad29.filesusr.com/ugd/cacfd7_5c012bbaf24f4974a901252b81785c55.pdf?index=true
    • https://s3.amazonaws.com/selivuvumepaveb/redilenimo.pdf
    • https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_6eb2dd393a11437d9d9790ed71af288a.pdf?index=true
    • https://s3.amazonaws.com/diwitapezu/arduino_driver_software.pdf
    • http://ruwimanolemagum.rf.gd/80752704494.pdf
    • https://s3.amazonaws.com/godewumazek/64911126652.pdf
    • https://b5f62e6e-b620-4b0e-90dd-fa81fc7fb5c2.filesusr.com/ugd/18d815_70799efeab1749cab0ea80ea1a0b9d19.pdf?index=true
    • https://uploads.strikinglycdn.com/files/709a7658-956d-408b-9779-6a17188df432/can_i_get_an_engineering_job_with_a_math_degree.pdf
    • https://uploads.strikinglycdn.com/files/5a59ceaf-ab27-49c5-9e06-894f8395f138/kagifofoxolosulazudizepo.pdf
    • https://s3.amazonaws.com/fidobakipivogit/how_long_is_a_diono_radian_rxt_good_for.pdf
    • https://uploads.strikinglycdn.com/files/d23f1eda-70a5-4358-8d1c-fd8938baceff/84820276473.pdf
    • https://a0bbd489-bf03-48a0-8e93-88abd0751e5b.filesusr.com/ugd/370ea2_ffdd1c53d1c14bcaaa16fb33fe6a7c52.pdf?index=true
    • https://s3.amazonaws.com/bipovoromoj/fire_incident_reporting_software.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9c7.bin
c3a34d7c31ea57b37b3f76cb69afd747b01c76f0485af0510d32921802865218		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9C7 5416 bytes
font_01_sfnt_off0000fc5c.bin
ad2d2777444288e1286d7e7bbdb3fdce3f922b119e57972dafdcb8c2a47a67b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC5C 11000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.