Malicious PDF — malware analysis report

Static analysis result for SHA-256 d70bb648c7a3640b…

MALICIOUS

PDF

67.7 KB Created: 2021-03-03 09:31:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00cb3512660347e8daef65ed8f16639b SHA-1: 4193244d0efea238247cfa1133f0f5bd1de6adc9 SHA-256: d70bb648c7a3640bb7b96a1bac83053fa69b5a02924019249bd84f3899edf20f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'zajinet.ru', which is likely used for phishing or credential harvesting. The PDF structure and embedded artifacts suggest it's designed to exploit vulnerabilities or trick users into visiting the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=midtown+eye+care+omaha+ne
    • https://cdn-cms.f-static.net/uploads/4469374/normal_601246bd67e27.pdf
    • http://videohost.space/ielts_speaking_marking_schemeuvjrr.pdf
    • http://dmgameplan.com/there_is_there_are_worksheetr12gw.pdf
    • https://cdn-cms.f-static.net/uploads/4447903/normal_5fd289b3b8d7d.pdf
    • http://rarurude.22web.org/beautiful_s_letter_hd_images.pdf
    • http://itfamily.info/jozixudosutumizujosibuplheb.pdf
    • https://cdn-cms.f-static.net/uploads/4465555/normal_6035cb0aed954.pdf
    • https://cdn-cms.f-static.net/uploads/4415052/normal_602b13454c930.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nonabafat/xokovajeto.pdf
    • https://s3.amazonaws.com/lekizopiloref/47332048279.pdf
    • https://s3.amazonaws.com/vexeliku/87184884201.pdf
    • http://nivufebolira.epizy.com/brdm_2_pubg_full_form.pdf
    • https://s3.amazonaws.com/musoxifuvitalo/mubugedokekor.pdf
    • https://s3.amazonaws.com/xeponodij/baforeziradodafi.pdf
    • https://s3.amazonaws.com/ximupuv/fovewe.pdf
    • http://rafopaju.rf.gd/median_from_frequency_tables_worksheet.pdf
    • https://s3.amazonaws.com/paropabaru/neziderefujenefo.pdf
    • http://wuxekijonudi.epizy.com/xotobalini.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd27.bin
47786798da4c51f11b3bfe524fb9e33cb9a43f686cab846d7cc8e65dd3d832f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD27 5168 bytes
font_01_sfnt_off0000deb2.bin
6a2f156324b509716d74d0b48c24b40865686fdca94dc17ed3e60ada707abc5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEB2 10392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.