Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb479a92fc1cc042…

MALICIOUS

PDF

78.7 KB Created: 2021-03-12 06:05:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 539815d90d598f456232b2bec9a9bcd2 SHA-1: e176c1c797d35f8c0976254e71c159c7336960af SHA-256: eb479a92fc1cc04257a9cba0fab30703285c6e587a4219e7db2a7235dfcc1c1a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents. One of the primary URLs extracted is zajinet.ru, which is likely part of a phishing or SEO spam campaign. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=biochemistry+stoker+pdf
    • https://gapefupekud.weebly.com/uploads/1/3/1/8/131871489/b48994dd.pdf
    • http://setafugeridol.scienceontheweb.net/uud_1945_amandemen_1_2_3_4.pdf
    • https://feliwisinawo.weebly.com/uploads/1/3/1/8/131856919/xijozuvozul-rinijoneg.pdf
    • https://kofavuzaxo.weebly.com/uploads/1/3/0/8/130873868/4504908.pdf
    • https://lojamagimom.weebly.com/uploads/1/3/0/9/130969840/mumameg.pdf
    • http://fejekadiwoxobiz.getenjoyment.net/porsche_944_owners_club_cars_for_sale.pdf
    • https://pinejose.weebly.com/uploads/1/3/4/4/134467182/9712034.pdf
    • https://kesegupopu.weebly.com/uploads/1/3/4/1/134131766/139593.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/73ce7f30-437e-456d-813f-18f89ade3366/gobiz.pdf
    • https://s3.amazonaws.com/jipowumat/jepiperatasobupitoliwufi.pdf
    • https://uploads.strikinglycdn.com/files/4738b567-3e46-4b52-9d1b-93e4ddb07376/robin_hood_castle_nottingham_prices.pdf
    • https://s3.amazonaws.com/viboxikuz/tafogepokenusis.pdf
    • https://uploads.strikinglycdn.com/files/f7fac81e-aa60-473a-9756-cacc84f71912/28207314347.pdf
    • https://s3.amazonaws.com/zemunomipazikez/lomalidixoxot.pdf
    • https://uploads.strikinglycdn.com/files/8886c74c-1d2c-46bb-8a3e-b45e5ae6fe95/navafodu.pdf
    • https://uploads.strikinglycdn.com/files/aa288e4d-e91c-46e9-a602-f7049783a33b/code_name_verity_summary_sparknotes.pdf
    • https://uploads.strikinglycdn.com/files/9decec44-d4cd-49b9-9557-7ba6f77f9fde/7161298268.pdf
    • http://mozutulobiris.onlinewebshop.net/alpha_phonics_vs_all_about_reading.pdf
    • https://uploads.strikinglycdn.com/files/2df2055c-b3ac-45c4-b41c-1dc40c62dacd/86591990054.pdf
    • https://uploads.strikinglycdn.com/files/0f7e258c-0b50-4c1c-bcad-e1e7910145a9/18935260447.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f56b.bin
38b610716350433188efae9b2a07f5a9aee8e0c1e968a314adfa5f29a5ef34f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF56B 5368 bytes
font_01_sfnt_off00010795.bin
e2b7aaea14b80d5f496bdb7155a74f02afbbec24404906807b7aa564dea25bf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10795 11112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.