Malicious PDF — malware analysis report

Static analysis result for SHA-256 d239a92698fbeee1…

MALICIOUS

PDF

77.0 KB Created: 2021-05-10 09:00:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: cf4256ecc001051908561c873f4cf89f SHA-1: de9ae82b29647f6bbdb229758d69ccaad19023c4 SHA-256: d239a92698fbeee1934d7610e2aa10b34641fe26bdda3fd78eca10c2558300ee
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous external URIs, including one pointing to 'zajinet.ru', which is likely part of a phishing lure. The document body, though heavily obfuscated, suggests it might be disguised as search results or informational content to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=what+is+an+example+of+a+objective+sentence PDF link annotation
    • http://fenellalucynelle.info/572615589998vmkf.pdfIn PDF document text
    • http://bottlechainworld.com/apc_back-ups_es_8_outlet_550va_120v_replacement_batteryouhez.pdfIn PDF document text
    • http://fisuruwibowin.66ghz.com/46192180330.pdfIn PDF document text
    • http://ita-women.space/zofenevosimiwaxupekztyei.pdfIn PDF document text
    • http://connexion-amelii.xyz/ms_7778_ver_1.0_motherboard_drivers_downloadkczar.pdfIn PDF document text
    • http://bitjoms.xyz/82500082522q084x.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ca4363f-0a04-4708-a032-5cbae38f0fce/53141272635.pdfIn PDF document text
    • https://s3.amazonaws.com/liwara/free_disney_violin_sheet_music.pdfIn PDF document text
    • http://xonefepuvimami.epizy.com/the_umbrella_academy_songs_free.pdfIn PDF document text
    • https://s3.amazonaws.com/teximikamukubo/game_developer_portfolio_template.pdfIn PDF document text
    • https://b998fa74-583e-446a-a2a7-67f41460fdb2.filesusr.com/ugd/e081f8_e4d1332b34c048ee8a8b0a3117cc5086.pdf?index=trueIn PDF document text
    • https://64b67c6e-fbbd-4787-add8-9ed3e274c95c.filesusr.com/ugd/eb6612_9f2f483fcd8246918f1caec1e7fae307.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce894825-2704-47e7-a22d-bd0754e16aad/vurebapodujabufamisij.pdfIn PDF document text
    • https://s3.amazonaws.com/kozibowisenatu/samsung_galaxy_s5_troubleshooting_black_screen.pdfIn PDF document text
    • https://42f4b946-f871-4f2a-a73e-6571c6569919.filesusr.com/ugd/e20521_6df58047eb0f4872b900e73064e9a299.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f82f797-4ff3-4e49-9073-07b28240ed64/cuisinart_dbm-8_supreme_grind_automatic_burr_mill_parts.pdfIn PDF document text
    • https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_737a7fdcdbab4e09b5936b01c7dcb000.pdf?index=trueIn PDF document text
    • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_98d42a114cf44a15bfd79bd72c78a5f0.pdf?index=trueIn PDF document text
    • http://zuzenif.rf.gd/sieve_analysis_test_for_sand.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bdf7a43-6fa2-47db-a102-565f6f81c06d/69340839482.pdfIn PDF document text
    • https://s3.amazonaws.com/zepifudoxapo/phonics_review_worksheets_grade_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b683b51-5fdf-4e16-a644-4bc2458a3242/64577677338.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/dizukugunit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF78 5516 bytes
SHA-256: 59062f21ddca1d74613b457f303248fdd4372968ba4e27050804a4ab8de3d382
font_01_sfnt_off00010232.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10232 10580 bytes
SHA-256: cd180c0f37116de339f70b5927fa1e39791fa2f5c820b3cc9b3e4dfdc470e843