Malicious PDF — malware analysis report

Static analysis result for SHA-256 f29e56f286d7778d…

MALICIOUS

PDF

73.7 KB Created: 2021-04-07 13:32:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3012cf3faf31928305b993f0ce842a45 SHA-1: d589e9ee8fcf326b0ff67d88fa2a4eb837c5a9ce SHA-256: f29e56f286d7778ddd9e23e0c032c3d30e760ec411c985005d2fd788995a4fb4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URI pointing to 'zajinet.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, contains text related to a hotel, suggesting a lure for users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/aws?utm_term=cannery+row+inn+hotel+monterey
    • https://cdn.sqhk.co/jolodovi/geie8tQ/52770572286.pdf
    • https://cdn.sqhk.co/gopuxipo/naMia8B/fufulobotozaziwuteko.pdf
    • https://cdn.sqhk.co/kululojilo/chhdhbk/tomeli.pdf
    • https://cdn.sqhk.co/xejudawadoni/jehgehf/pirates_showdown_full_free_mod_apk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dapekufoxiraku/23207386289.pdf
    • https://uploads.strikinglycdn.com/files/c33492bc-a5de-4433-a008-9373a0257a7d/72019381457.pdf
    • https://uploads.strikinglycdn.com/files/b38d22a7-3583-4bed-87a9-3b9a07413652/kukegudigu.pdf
    • https://uploads.strikinglycdn.com/files/d08578a7-aab7-4ba2-aff4-7f444b59859f/how_to_watch_big_little_lies_for_free.pdf
    • https://uploads.strikinglycdn.com/files/3bcebba3-f3e9-4c4b-b7e9-2dd007a853c5/1000_verbos_en_ingles_y_espaol.pdf
    • https://uploads.strikinglycdn.com/files/87d09262-f88c-45d1-91a0-628fdd4cb4ad/how_to_make_bat_at_home_with_paper.pdf
    • https://uploads.strikinglycdn.com/files/8276cfee-6047-42a3-a4ca-5afab69ceca9/lazerodejiv.pdf
    • https://s3.amazonaws.com/navoburarovada/32697144504.pdf
    • https://uploads.strikinglycdn.com/files/00b5cbd3-0809-49ca-81e9-38487c1e48dc/sepopaxewagagowajijafajo.pdf
    • https://uploads.strikinglycdn.com/files/931ac50f-394e-490c-b83e-4c0fd49f1650/stand_by_me_lyrics_english.pdf
    • https://uploads.strikinglycdn.com/files/f14d1310-fd50-4573-bed0-ebdd32609a5a/14350546160.pdf
    • https://s3.amazonaws.com/wolawatin/can_you_have_a_dating_scan_at_7_weeks.pdf
    • https://uploads.strikinglycdn.com/files/62fa11b5-1a64-4ab2-8ccc-278d9bbf93ba/kefejoxuwejogavomu.pdf
    • https://s3.amazonaws.com/fifuto/34289962359.pdf
    • https://uploads.strikinglycdn.com/files/2cca7e2d-fbda-4c01-9e26-8522268bb7f1/gijorijozaramivirul.pdf
    • https://s3.amazonaws.com/joterige/teachers_day_special_images.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e47e.bin
cb51c83f78b537168750e0f75780d590d469f2727f65d30cf9695048bc9b6bba		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE47E 4848 bytes
font_01_sfnt_off0000f4e0.bin
3c1ea337a6aabcd6e3abd4fce798ab015245218b318e1f4cdcb3e29578647f2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4E0 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.