Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7cf795e43ec1120…

MALICIOUS

PDF

65.4 KB Created: 2021-02-28 15:30:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 7b23cbb4a2f9763b5723e17635ba3a4f SHA-1: 86959b0a1a1a0be147ef0c7d8ad9fb99c91a45fd SHA-256: b7cf795e43ec112090f442d9cb4773a98f7313a96b51a651b6a89ff58f322571
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One of the primary external URIs points to 'zajinet.ru', which is likely part of a malicious campaign. The ML classifier and ClamAV detection further support the malicious nature of the file, indicating it's a phishing or trojan distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8307

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=greek+gods+and+goddesses+list+of+names+and+powers+and+pictures PDF link annotation
    • https://xevusopavavi.weebly.com/uploads/1/3/4/6/134632984/terovoliduxubej.pdfIn PDF document text
    • https://bijivabaj.weebly.com/uploads/1/3/4/6/134601785/giwoxugatanurirupa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415769/normal_5fd2572d47704.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420587/normal_5ffdf229515f3.pdfIn PDF document text
    • http://kidepokapila.22web.org/broadsheet_coffee_roasters_cambridge_ma.pdfIn PDF document text
    • https://dagakaxogofawi.weebly.com/uploads/1/3/4/6/134699425/xewasev.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423155/normal_6021ce76cc25c.pdfIn PDF document text
    • https://nulabelavomeviz.weebly.com/uploads/1/3/1/4/131413951/057bb6a.pdfIn PDF document text
    • http://xemopubuga.iblogger.org/xijujilusimidirijotafifa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dowadotiju/artistic_milliners_annual_report_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/kenixosokikofisupi.pdfIn PDF document text
    • https://s3.amazonaws.com/jasadavebaga/92805176979.pdfIn PDF document text
    • https://s3.amazonaws.com/jixeremipet/zolaragedurawurekodusufiw.pdfIn PDF document text
    • https://s3.amazonaws.com/zufaxepixiguxax/best_ruger_lcp_2_pocket_holster.pdfIn PDF document text
    • https://s3.amazonaws.com/sobaketemu/top_4k_video_website.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCDD 5664 bytes
SHA-256: ab4f9e47f02938c2612636f54aeb0dfcda1582d1336f304e7c29d5d47c47b860

Open this report in the interactive analyzer, or submit your own file for analysis.