Malicious PDF — malware analysis report

Static analysis result for SHA-256 d875a9d59b19de72…

MALICIOUS

PDF

88.5 KB Created: 2021-05-13 23:48:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb1ed6514adb527c2805c3f8251c1289 SHA-1: 7233ab2eb6b54afb6f05fdfc7181c82dd6b471e7 SHA-256: d875a9d59b19de72d1efd31ce70dcb7eb43b976071454626cce723e729367eac
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers indicated a high probability of maliciousness. It contains a large number of external links, with one prominent URL pointing to zajinet.ru, suggesting a link farm or phishing attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a book title, indicating a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=knight+of+the+seven+kingdoms+book+2
    • http://jetavof.sportsontheweb.net/bhagavad_gita_in_english_complete_download.pdf
    • http://toxipoxekej.medianewsonline.com/14625999526.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ff33141b-1d20-4bfe-888a-449fcc3d2191/89727488676.pdf
    • https://uploads.strikinglycdn.com/files/a9a6be99-8426-4886-8992-4a186008c0dd/princeton_review_gre_book_2018.pdf
    • https://uploads.strikinglycdn.com/files/8be32b7c-0aa5-4c28-9af9-b24d81f92042/psychological_assessment_and_consulting_muncie_indiana.pdf
    • https://dba0ca6b-c979-46b3-87c9-041648dee063.filesusr.com/ugd/6f58fb_6798d92ab69948cc8a71ac30b6e8dc53.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fef853a5-523c-47dd-94bb-ba1bc7a8efcd/what_is_co-prime_number_meaning.pdf
    • https://uploads.strikinglycdn.com/files/cb9d6ef6-ad93-416a-963a-b2c000694eb6/fuvokesofizel.pdf
    • http://zubiluwetij.myartsonline.com/toduvimawifezoxalejagomi.pdf
    • http://nanaxidimidi.atwebpages.com/tonawebeditu.pdf
    • https://uploads.strikinglycdn.com/files/92507928-3ac9-4e96-ac69-ef9a5b23a8b6/how_to_fix_a_flooded_snowblower.pdf
    • https://uploads.strikinglycdn.com/files/a9b0f316-ffdc-4589-8241-ec1026458bd3/scooter_flat_tire_repair_near_me.pdf
    • https://uploads.strikinglycdn.com/files/db1632b7-1d73-4b4f-b011-63982bd2f004/nyssma_all_state_application.pdf
    • https://uploads.strikinglycdn.com/files/04d61a9e-ef50-4595-b667-959c64fa24c6/62053290632.pdf
    • https://uploads.strikinglycdn.com/files/ffbf92ee-9297-4df8-8a0f-5983132e3cec/48495010823.pdf
    • http://bejanifezilo.atwebpages.com/vovuvoruvizebusobonev.pdf
    • https://0e01c86c-6ad9-43de-bc04-b8819f410213.filesusr.com/ugd/73c254_4b84f9f555a742d8af87d6acac4d4822.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6d5e2c1b-6175-4a42-8feb-1e10f6e2671d/sketchup_2015_free_download_with_crack_64_bit.pdf
    • https://uploads.strikinglycdn.com/files/42acee0a-e235-4c2f-86f2-dd372d6510c9/describe_the_reconstruction_plans_for_presidents_lincoln_and_johnson.pdf
    • https://uploads.strikinglycdn.com/files/2cd4e9e7-6c57-4e53-9dea-bc4b85cbb2e3/brother_hl_2270dw_wireless_setup_download.pdf
    • https://uploads.strikinglycdn.com/files/1274b1a0-6b38-41d2-91f6-bd2a320607d2/fiddler_on_the_roof_sunrise_sunset_sheet_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011b9f.bin
2962f804bda67bbb48fe227ab8ad76b2176aa23213ea6670049c93dfaea01f80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B9F 5348 bytes
font_01_sfnt_off00012dc5.bin
f724386d67f29f40f6a4cbe2b24df3e4405e9312a22da7f9d47b6ed4b4e58852		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DC5 11244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.