Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee0c719bdc311620…

MALICIOUS

PDF

72.4 KB Created: 2021-04-04 09:59:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7eab2f870899d0fe5ca4a88edcc78e5 SHA-1: 26d0abed4bc38ad9813ec28bf4551309f5fae079 SHA-256: ee0c719bdc311620190fed5e174258c031c4a5ebb5fd0dcc03f965506546672a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, pointing towards a phishing or SEO manipulation scheme. The presence of an external URI to 'zajinet.ru' further supports this, as it is likely a malicious or compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=how+much+does+a+head+of+operations+make
    • https://static.s123-cdn-static.com/uploads/4402504/normal_5feb0c4512267.pdf
    • https://cdn-cms.f-static.net/uploads/4407807/normal_6067b45e6d643.pdf
    • https://cdn-cms.f-static.net/uploads/4464734/normal_6043ee2f5435b.pdf
    • https://cdn-cms.f-static.net/uploads/4411921/normal_60652ac817f86.pdf
    • https://cdn.sqhk.co/sinemajud/JxHhjjd/8094668956.pdf
    • https://cdn.sqhk.co/gajerivab/jhjeigc/maze_runner_book_2_summary.pdf
    • https://cdn.sqhk.co/fuvebopeweb/AChbj9G/english_songs_with_lyrics_download_video.pdf
    • https://cdn.sqhk.co/wenejusuzixe/hchhU6D/lubirarosavupil.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2d7825ef-d2b0-4eab-bb82-d79f09b8e837/93463633790.pdf
    • https://uploads.strikinglycdn.com/files/930dedf9-89c7-41b5-82fb-698fcba61d10/toshiba_satellite_l755_audio_drivers_windows_7.pdf
    • https://e60c805d-b9e1-47fc-b045-983511e9ac1f.filesusr.com/ugd/116bb2_76b6153743e546e4a1c985ca9953dc64.pdf?index=true
    • https://84d51d8d-5932-465a-b044-5d36dace581c.filesusr.com/ugd/98e2de_163d7800261f4dbfa3bcfb29831d8b54.pdf?index=true
    • https://45884d5c-3037-4093-99f9-9b9c28a1e9f0.filesusr.com/ugd/3721b1_d597d5f3d73947c4b51b508dad09a64c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a4872c26-7e53-476b-9ac8-7c9fa8724d6a/lotos_plasma_cutter_review.pdf
    • https://f39f7cea-6337-46de-af4f-699959e6db0a.filesusr.com/ugd/004672_059cc5d7dc06407d8608387c3bccef81.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9c1490aa-478f-4591-b5d0-c55ab17fd4d3/sunbeam_water_cooler_parts_ylr2-5-90hz3.pdf
    • https://uploads.strikinglycdn.com/files/7c7b41ea-a29c-46c8-a413-f2e409031d87/sifagilemudilexezipe.pdf
    • https://uploads.strikinglycdn.com/files/34751477-bb7e-4058-ac42-ad3aab49dfd3/how_to_clean_a_hobart_slicer.pdf
    • https://926da24b-d3df-4aea-ac1b-ebdf7359a9e7.filesusr.com/ugd/fef925_1de85c8e18804d228d12a00fbce99b1e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/86e05b4b-7dd6-45fe-b4b7-0fafb55f37c4/what_is_a_good_experiment_for_the_scientific_method.pdf
    • https://uploads.strikinglycdn.com/files/bc3d2d4e-22ff-4536-abec-26f62f059b47/wubebitu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd8f.bin
b65b4be18ca7b567c7c6d7ef572b2979caf451dd356f80b470c567af142e7b8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD8F 5480 bytes
font_01_sfnt_off0000f018.bin
98f8e0e0ed54d3f4ac82afedc306f72817526e3d39cbfc1f76812edfbc085d9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF018 10492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.