Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4188e191640c76a…

MALICIOUS

PDF

72.7 KB Created: 2021-03-04 01:22:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3ba0922ac011784392c90fc5a9a29f25 SHA-1: d044252ccf35b88904276c4289200c7ffb078a6a SHA-256: e4188e191640c76aa23bda484bdc5c601406ae836e51cde564d410a3bf540a0c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'zajinet.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to 'Nyc tour guide quizlet', aiming to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=nyc+tour+guide+quizlet
    • http://getegenufiduso.66ghz.com/anuga_2018_exhibitor_list.pdf
    • http://world-wild-shop.com/kisanuzoboxorefisuwkkv54.pdf
    • http://sarhello.online/diwojuwebonanejln7v9.pdf
    • http://lnstagramverificationbadge.com/spiritism_allan_kardec7f48n.pdf
    • http://dumubemajizukov.medianewsonline.com/bluebook_20th_edition_citation_format_examples.pdf
    • http://pubguckazan.com/jiragorebaw8z4b8.pdf
    • http://agencymedia-ig.com/citizenship_in_the_nation_merit_badge_worksheet_2019inrj9.pdf
    • http://babysampler.com/358670487904rtvx.pdf
    • http://tur8osale.site/64149105867ui91n.pdf
    • http://mini-cam-v2.club/purpose_of_descriptive_researchf3eag.pdf
    • http://googsnat.space/distribucin_normal_estndar_ejemplos_resueltosqcspt.pdf
    • http://instapriz365.online/bible_verses_about_prayers_not_being_answeredf2erj.pdf
    • https://vozokeku.weebly.com/uploads/1/3/1/8/131857213/1613143.pdf
    • http://4kuhd.me/22794294024dwsf2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kegunujav.epizy.com/rigilumew.pdf
    • http://zubumedi.rf.gd/automobile_spare_parts_shop_project_report.pdf
    • http://bawilifugoxak.epizy.com/39160808095.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfe1.bin
c600ad1c4717ebf7903ce86aad3321fdf4d1ff323674c36dd5c3d4f7e9000f00		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFE1 4968 bytes
font_01_sfnt_off0000f0e2.bin
1bb778cfd73d2a80fe5d6171c0dca348d68df68a328738cf21004b952d0e3fbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0E2 10980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.