Malicious PDF — malware analysis report

Static analysis result for SHA-256 b88137add5eb8ef8…

MALICIOUS

PDF

87.2 KB Created: 2021-03-22 14:40:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 20a9311c1e9a586ebd33298da2057be1 SHA-1: 9cd0cef8f055215461ef628e8a20f14778fc59ca SHA-256: b88137add5eb8ef84972515273badbbaeda4917b889f4ee6e30c9acb33d709c2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with the primary one being 'https://zajinet.ru/strik?utm_term=leadership+101+john+maxwell+powerpoint', suggesting a phishing or malware delivery attempt. ClamAV detection and ML classification strongly indicate maliciousness. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=leadership+101+john+maxwell+powerpoint
    • http://agent-spv.space/wixabewodonelpt5l.pdf
    • http://kigurumi.org/881841355739c6mn.pdf
    • http://koolmaxt.online/evaluating_expressions_with_exponents_and_parentheses_worksheets0pbkb.pdf
    • http://nefidale.22web.org/82275929900.pdf
    • http://emmetrix.net/aditya_birla_logo82e2w.pdf
    • https://static.s123-cdn-static.com/uploads/4391008/normal_600452b342832.pdf
    • https://cdn-cms.f-static.net/uploads/4404983/normal_6037904f715e6.pdf
    • http://trenolgia.buzz/rifavarorarijitsg0q6.pdf
    • https://static.s123-cdn-static.com/uploads/4403129/normal_5fddf77ff303d.pdf
    • http://pifovabu.getenjoyment.net/carpal_tunnel_syndrome_indonesia.pdf
    • http://cocobuka3.xyz/78215384703djy31.pdf
    • http://smartcoin.design/schlage_keypad_deadbolt_user_guide4l906.pdf
    • http://nikecortez.net/visual_basic_for_applications_tutorial_word3d1xr.pdf
    • https://cdn-cms.f-static.net/uploads/4414336/normal_600dd0f098a0d.pdf
    • http://xufededubumavif.scienceontheweb.net/garmin_gtn_750_installation_manual.pdf
    • https://static.s123-cdn-static.com/uploads/4483602/normal_5fc7dd2e025c2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://39c3e2ba-dcb8-4bc0-9ed7-0058f02c59d5.filesusr.com/ugd/fd4c29_46d643d8738f40f2938bb9e7efc22359.pdf?index=true
    • http://noratev.myartsonline.com/gekitujirazofakaxuve.pdf
    • http://donenufalu.rf.gd/gyriform_restricted_diffusion_radiology.pdf
    • http://kujujigufa.epizy.com/jasogisudaxetolamul.pdf
    • http://degepedafapuf.epizy.com/movies_utorrent_2018.pdf
    • https://8533cbf3-c0d6-400c-bdf8-8ca38cf0242b.filesusr.com/ugd/135178_d6d2c6fb67844e03b68ca347dab98559.pdf?index=true
    • https://11627308-8c8f-4f08-99ed-0ad85160907d.filesusr.com/ugd/682d1c_539c892470fc4124871c83e1ff8c4a46.pdf?index=true
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_0aa0e1a344974421a5657bd6041639fb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ad8.bin
f483e12c4ff09d1b10240c11879fe38a30d126b9dc7a6e2a8925b630d7c30bb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AD8 5356 bytes
font_01_sfnt_off00011cf4.bin
4274b7431d96f122eb42ba1f6f6e5b0545de78f845f5df8de47e60113cdda40d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF4 10716 bytes
font_02_sfnt_off00014147.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14147 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.