Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4165bfca4695a76…

MALICIOUS

PDF

79.7 KB Created: 2021-05-07 01:43:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e9b8d9cf6f0ea9f1e889827f25db239 SHA-1: bce02147a97a46fe2ace9a18415d1f6fc4b73bdf SHA-256: c4165bfca4695a76cb883a145f1553c97dde7fc99d293fcae92a3c4cc8509841
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains numerous external URLs, with a primary one leading to 'zajinet.ru', likely serving as a lure for users interested in financial topics. The document body is heavily obfuscated, preventing a clear understanding of its specific content beyond the title, but the overall structure and URL distribution suggest a link farm designed to redirect users to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=how+to+find+the+n+in+compound+interest
    • https://cdn-cms.f-static.net/uploads/4393345/normal_604fcbebcaef1.pdf
    • http://vojemodipu.sportsontheweb.net/fogebisegosufo.pdf
    • http://supesanav.iblogger.org/c._n._banwell_spectroscopy.pdf
    • https://static.s123-cdn-static.com/uploads/4461484/normal_60049cff556eb.pdf
    • https://botabire.weebly.com/uploads/1/3/4/6/134629411/zajiv.pdf
    • https://lazekikobetilof.weebly.com/uploads/1/3/4/4/134443651/livinuv_dudowomo_falilo.pdf
    • https://sidomepavoresob.weebly.com/uploads/1/3/5/3/135322675/liwal-jekugi-josurukiwokirap.pdf
    • https://cdn-cms.f-static.net/uploads/4406777/normal_601673a18028a.pdf
    • https://cdn-cms.f-static.net/uploads/4459470/normal_601aefa367596.pdf
    • https://cdn-cms.f-static.net/uploads/4390381/normal_6039d6262e496.pdf
    • https://cdn.sqhk.co/jomutepe/ffjahhR/womafuxid.pdf
    • http://bukudix.getenjoyment.net/capra_cu_trei_iezi_poveste.pdf
    • https://cdn.sqhk.co/kajipazuto/dEFKido/facebook_logo_white_vector.pdf
    • http://wivaserana.mywebcommunity.org/a_que_se_debe_el_dolor_en_la_espalda.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kixixiwibatogit.epizy.com/akg_y500_manual.pdf
    • https://53ee2ee6-42da-4c96-954f-60f726bc8d53.filesusr.com/ugd/de2744_53e7be8c30a74b3db94cfaf3bc053828.pdf?index=true
    • https://6ae5a9c1-8526-45f7-b068-03ddf2465b28.filesusr.com/ugd/87f732_4469aeed7b78407ebd26c6045d4b7f78.pdf?index=true
    • http://rajivapaw.rf.gd/camping_checklist_australia.pdf
    • https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_440f1963bf734124a2d0dd8ca21ace25.pdf?index=true
    • http://pisimupalokules.epizy.com/49163619217.pdf
    • http://farudigenudoze.onlinewebshop.net/summary_of_poem_on_his_blindness.pdf
    • http://burevomekevi.rf.gd/upsc_maths_optional_books_free_download.pdf
    • http://mugazukadum.onlinewebshop.net/music_2252_osu_syllabus.pdf
    • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_aa986f852dcb4383b8a19f241e334381.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f610.bin
ff4d8d58c56642194c0ca558f36c653c10f4c4e054097161ef61653a32438ee2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF610 5204 bytes
font_01_sfnt_off000107b0.bin
6a22262a716dd8878506406d7632b52236f8ad1d016963881037899b1f3db651		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107B0 12108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.