Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef7a75219d608429…

MALICIOUS

PDF

81.3 KB Created: 2021-04-20 15:20:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3aba4241f11b842195e0949c297a7e3a SHA-1: b5e77a08897bcf6610187f76fd785974dec102f3 SHA-256: ef7a75219d608429e8ef748ecf0237c01ae94fd1303a68ea208a7811c4267000
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The document body, though partially garbled, contains text related to 'Trombosis venosa profunda sintomas y tratamiento' and the authoring application 'wkhtmltopdf', suggesting a lure. A key finding is the external URI pointing to 'https://zajinet.ru/strik?utm_term=trombosis+venosa+profunda+sintomas+y+tratamiento', which is highly suspicious and likely the primary objective of this malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=trombosis+venosa+profunda+sintomas+y+tratamiento
    • https://cdn.sqhk.co/gebemiwisero/ibpvTgf/motosport_phone_number.pdf
    • http://benodemutuvi.22web.org/pifezenobapedozixukajo.pdf
    • https://cdn.sqhk.co/kujexelorite/Vijhgji/flipper_bird_purple_shep_pokemon.pdf
    • https://cdn.sqhk.co/pajokiman/hFje5jj/76796948591.pdf
    • http://vukosam.22web.org/1837601146.pdf
    • https://cdn.sqhk.co/savunowudob/iihcsjf/can_you_escape_adventure_level_1.pdf
    • https://cdn.sqhk.co/mudinaxape/hghjujb/bad_grandpa_full_movie_cast.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/e3256e8e-490b-493a-8960-72b778d1cf4a/data_warehousing_informatica_interview_questions_answers.pdf
    • https://uploads.strikinglycdn.com/files/13c1372a-ea5a-4282-8f61-f7623aa5bf4c/socratic_questioning_techniques.pdf
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_6d529e53bda346b6bb0e664ccfe81967.pdf?index=true
    • http://guroven.rf.gd/vikokiwojazatazajim.pdf
    • https://e8802323-0824-40c5-8a58-19d700e27586.filesusr.com/ugd/50cafd_c37a7f8928fb409593aa6e7f8cef0f47.pdf?index=true
    • https://uploads.strikinglycdn.com/files/48dca611-9a78-4ed1-ac4b-7445fdb5c8cf/45858101218.pdf
    • https://uploads.strikinglycdn.com/files/73a18c5c-84c3-458d-ada5-36dc257f3b9f/45158284813.pdf
    • https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_53662d1ffa334dffb89eec1c4a40c46e.pdf?index=true
    • https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_fc33ce7f10c04a489b9105099744c329.pdf?index=true
    • http://javixisapuv.epizy.com/18592280335.pdf
    • http://pavebutom.epizy.com/english_idioms_with_meanings.pdf
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_da863aead5c444758b92b7686ca215fa.pdf?index=true
    • https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_f0fe044be6c34c618fc49d4a359f47af.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1a7bf4df-229c-4a87-9471-1804827a9f50/nidemuxigobeza.pdf
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_6644b4fd5e7f4df3acf76b877bb3d32e.pdf?index=true
    • https://67dc9804-4028-4298-afd7-d431d2c16fe6.filesusr.com/ugd/559c84_6284c6a0414e448692063afb4232e8df.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f081.bin
ba801135edf6fa4d1d70afa7c14de8214cb9d7f40c63e8daa960305e5c3179ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF081 5288 bytes
font_01_sfnt_off00010265.bin
059c0dee542eaf7ba1aad8b0e8d235fbcce389c777d891f0312539d5512c68a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10265 11396 bytes
font_02_sfnt_off00012774.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12774 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.