Malicious PDF — malware analysis report

Static analysis result for SHA-256 f328b6dce116373d…

MALICIOUS

PDF

77.2 KB Created: 2021-03-15 08:53:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: f243a173b8ab4ea5095804c7625541b6 SHA-1: b5914dfbb07385ff22809643ff693d9929d3de39 SHA-256: f328b6dce116373d53f4db64ed2065627edaa482cfb63ded7b9fe678d43de89c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high heuristic score for external URI usage. The embedded URL 'https://zajinet.ru/strik?utm_term=what+temperature+is+food+safe+at' suggests a phishing attempt disguised as an informational document. Although no scripts were explicitly extracted, the PDF structure and the presence of external URLs indicate a likely attempt to redirect the user to a malicious site, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=what+temperature+is+food+safe+at PDF link annotation
    • http://bigowet.xyz/looking_for_alaska_john_green_book_review43tmk.pdfIn PDF document text
    • http://kitafoged.medianewsonline.com/page_replacement_algorithms_examples.pdfIn PDF document text
    • http://hq-cleartv.info/tesimebilawam1wldo.pdfIn PDF document text
    • http://pasadurasasagi.medianewsonline.com/probability_sampling_method.pdfIn PDF document text
    • http://puwinowelin.medianewsonline.com/iron_carbon_diagram_explained.pdfIn PDF document text
    • http://copyrightram.net/free_online_games_for_kids_no_download_robloxw1gt6.pdfIn PDF document text
    • http://useporte.xyz/29682916760qgq3b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://994180ce-385f-4272-9833-4a204a825e0f.filesusr.com/ugd/ec0c41_1b58dd9896ae434da885660e7e4db506.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jobavo/dragon_nest_lunar_knight_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf5e4d86-7ab2-4228-a661-6d36f8a2790a/11723608100.pdfIn PDF document text
    • https://b40f07b9-a98f-42b6-a6e2-5dc2c82ebb0e.filesusr.com/ugd/e949ea_8b1edef87141454aaee1ad8e733c956a.pdf?index=trueIn PDF document text
    • https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_bcf35d7229ce43788aab78581f5b2eab.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nilititonawafim/3._5_insectile_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67ef5de6-1d26-4b8e-b311-0a855caa9177/34721740677.pdfIn PDF document text
    • https://s3.amazonaws.com/gogonof/report_writing_activities_for_esl_students.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af0e4465-372f-448d-a304-5ad6989d43a2/worksheet_mixed_problems-mole_mole_and_molar_mass.pdfIn PDF document text
    • https://s3.amazonaws.com/widofafane/70303290733.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/921d26c4-24f5-4259-827f-46fc0db28602/cnc_turning_programming_books.pdfIn PDF document text
    • https://s3.amazonaws.com/vonutavekip/tubez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9c22a26-5828-48f7-8e7a-96bc537a2b5a/what_is_the_software_development_life_cycle_model.pdfIn PDF document text
    • http://sitafefisoju.atwebpages.com/how_to_measure_dress_size_for_ladies.pdfIn PDF document text
    • https://cf587a47-7c2f-4f55-8bbb-21a4c73503f7.filesusr.com/ugd/8ea597_a372a93cac9d4e14913fccfabc513006.pdf?index=trueIn PDF document text
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_d782090929d14e7dbb8e0b5fa37d03e2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE41 5264 bytes
SHA-256: 3ac9a3e149462728213fab24c56cad27db030e2d85e1a39656bec125c861aa02
font_01_sfnt_off00010008.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10008 11108 bytes
SHA-256: 738c364aa7279dde0ca9a3072e9cd71e4b94aaf48cda08611862b1239042b780

Open this report in the interactive analyzer, or submit your own file for analysis.