Malicious PDF — malware analysis report

Static analysis result for SHA-256 c32b502fbba5e74a…

MALICIOUS

PDF

316.1 KB Created: 2021-03-11 08:48:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4377354394e27d5bba13a13cb0078415 SHA-1: e654c07c72d0634c9b7f918cc661a8ef4bd5b565 SHA-256: c32b502fbba5e74a4b638a00c541113937ba131dbde06dd72e178832dbba6f65
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'zajinet.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to character translation, aiming to trick users into visiting the malicious URL. No scripts were extracted, but the presence of external URIs and the ML detection strongly indicate a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9911

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=chinese+characters+to+english+pdf
    • https://cdn-cms.f-static.net/uploads/4451551/normal_5fd22aa4c0201.pdf
    • http://fazurusitu.getenjoyment.net/jopiro.pdf
    • https://somokowu.weebly.com/uploads/1/3/1/3/131383604/lexaxebejo-bunomiwenotofa-sezuras.pdf
    • https://cdn-cms.f-static.net/uploads/4389097/normal_5fe92c6c515ce.pdf
    • https://banetopebored.weebly.com/uploads/1/3/4/8/134874573/50deecf.pdf
    • https://sibomimotilelib.weebly.com/uploads/1/3/4/2/134235458/660a8e5856a94.pdf
    • https://nukanomipixi.weebly.com/uploads/1/3/2/7/132740264/2779929.pdf
    • http://luxshop21.site/muvozowirurumoxopubusofanyxhu.pdf
    • https://minadefimufev.weebly.com/uploads/1/3/4/6/134635785/4a02c.pdf
    • http://ecosbor.net/evening_shift_jobs_hiring_near_meu4w3d.pdf
    • http://hookup153.fun/318090483406b7kn.pdf
    • http://mx50off.pro/graco_snugride_click_connect_35_lx_manualmjx5n.pdf
    • https://cdn-cms.f-static.net/uploads/4371247/normal_603bfe030b33f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wujodibu/72042049326.pdf
    • http://tasefabomodewiv.epizy.com/china_flag_template_to_colour.pdf
    • http://putazosaw.epizy.com/street_fighter_iv_hd_mod_apk.pdf
    • http://gamelaluwer.myartsonline.com/fafije.pdf
    • https://s3.amazonaws.com/xeponodij/zupilimuta.pdf
    • https://s3.amazonaws.com/jopomodilamego/72520639610.pdf
    • https://s3.amazonaws.com/tiniruru/free_tarot_reading_books_online.pdf
    • https://s3.amazonaws.com/lowuwofuxali/archon_information_systems_llc_new_orleans.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000258d7.bin
94fbd4151d0de53fb22e3b17ebb8c44f5967ee9d839d179ab4d4f86512053718		 pdf-font-stream PDF embedded font (sfnt) at offset 0x258D7 188952 bytes
font_01_sfnt_off00047f20.bin
64face19b35c3753b2dc8d736fad3648d5bbe70c88807a89452021dfa7765746		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47F20 5320 bytes
font_02_sfnt_off00049131.bin
77b33108758e921a6287b9a2702f540ba5f3cb86329a615f049c653c6d36c1b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49131 20932 bytes
font_03_sfnt_off0004caa5.bin
d53d347cea387c54c087b2cd85ea94373ed5f2f525a48ba1569850c62da8c160		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CAA5 16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.