Malicious PDF — malware analysis report

Static analysis result for SHA-256 cca16eb25253a590…

MALICIOUS

PDF

74.3 KB Created: 2021-04-22 00:12:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: ec6320fc61940fb05c9ea1d86e925fa0 SHA-1: 24d49f175590716ac5c0f5aef92f236fc747cdef SHA-256: cca16eb25253a5901618266855e4d63daf4bdff368c416c378321cd82b6babef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://zajinet.ru/strik?utm_term=is+di2+bluetooth', which is likely a phishing lure. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=is+di2+bluetooth PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454302/normal_60582694ad340.pdfIn PDF document text
    • http://hhizmet.com/how_to_use_the_new_rainbow_vacuumgl2np.pdfIn PDF document text
    • http://kaxonabiso.22web.org/66507062566.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4527108/normal_602e4f4515115.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366306/normal_5fdb1d3290bde.pdfIn PDF document text
    • http://podenepusow.22web.org/what_is_the_main_theme_of_the_poem_harlem.pdfIn PDF document text
    • http://chtotakoeverti.biz/moultrie_game_camera_apphq60o.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449187/normal_606d943f901ff.pdfIn PDF document text
    • http://vkrowl.com/how_much_does_a_masters_in_biology_makeuo4is.pdfIn PDF document text
    • http://dsv-trening.ru/how_to_use_classes_in_python_3d2fu8.pdfIn PDF document text
    • http://stassikorskyi.com/how_do_you_do_a_double_crochet_for_beginners0ul09.pdfIn PDF document text
    • http://lotto-investclub.com/how_to_breed_the_pokemon_you_want_with_no_experienceggeb7.pdfIn PDF document text
    • http://alsamcctv.com/how_to_determine_the_reliability_of_a_research_instrumentdwg1c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382953/normal_5fe11b9442909.pdfIn PDF document text
    • http://magazok.top/krk_rokit_5_g1_pricelg94t.pdfIn PDF document text
    • http://bitcoinchat.fun/suwatufo95es1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/forupokisip/41996936035.pdfIn PDF document text
    • http://xososalubebejen.rf.gd/variety_rice_recipes_in_tamil_language.pdfIn PDF document text
    • https://s3.amazonaws.com/nedijowewoded/swiffer_wetjet_mop_not_working.pdfIn PDF document text
    • https://s3.amazonaws.com/difigomisosak/d_type_flip_flop_datasheet.pdfIn PDF document text
    • https://s3.amazonaws.com/jedaxopopuko/what_jobs_can_you_do_with_a_civil_engineering_degree.pdfIn PDF document text
    • https://s3.amazonaws.com/tobaziw/41042936992.pdfIn PDF document text
    • https://s3.amazonaws.com/gonima/bagokewodiri.pdfIn PDF document text
    • https://s3.amazonaws.com/dosalapasenow/what_is_a_dramatic_foil_in_literature.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e80b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE80B 4816 bytes
SHA-256: d8911c3e1df4231b24b65c798d3b53dc711d66bb64e4f2e1478af2235d56dafc
font_01_sfnt_off0000f862.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF862 10468 bytes
SHA-256: 7d91122509149cf48551fa54c8f03cb30da64f92b876b61e4e7b50e7e84d6801

Open this report in the interactive analyzer, or submit your own file for analysis.