Malicious PDF — malware analysis report

Static analysis result for SHA-256 f93d900015dbf91a…

MALICIOUS

PDF

77.4 KB Created: 2021-03-14 00:50:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9794e16d6b280a87394e4ba9b1b8eb22 SHA-1: e0cd6db6b4ccffa822c165d1eba671d4280efdd1 SHA-256: f93d900015dbf91a57027b3e6fb4a1ddf3c81f493cc2dfcaf70d5f0a6ab77c37
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded URLs, one of which, 'https://zajinet.ru/strik?utm_term=propiedades+opticas+de+los+materiales+dentales+pdf', is flagged as suspicious and likely leads to a malicious site. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is part of a link farm on disposable hosting, further suggesting malicious intent. ClamAV detection confirms this as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=propiedades+opticas+de+los+materiales+dentales+pdf
    • https://giximanuv.weebly.com/uploads/1/3/4/5/134526051/2722197.pdf
    • http://makululi.iblogger.org/komupalalujetakizam.pdf
    • http://zamuxodub.22web.org/xakelifu.pdf
    • https://sopezafenivi.weebly.com/uploads/1/3/0/9/130969371/5731329.pdf
    • https://dumetokewip.weebly.com/uploads/1/3/4/3/134394823/5227783.pdf
    • https://xuxulavadimuxa.weebly.com/uploads/1/3/4/2/134234789/2821006.pdf
    • https://zotizoju.weebly.com/uploads/1/3/5/3/135349435/6832b4fb.pdf
    • https://xavilisepu.weebly.com/uploads/1/3/4/2/134235747/7729423.pdf
    • https://godebisexizo.weebly.com/uploads/1/3/0/7/130775633/1489545.pdf
    • http://kizawaro.22web.org/90689190601.pdf
    • http://kokilubowo.22web.org/57946410755.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mivajodeki.epizy.com/pijawososilakokuxemojeja.pdf
    • https://s3.amazonaws.com/fekife/kuvabukojezinagag.pdf
    • http://fisuzes.epizy.com/python_3_for_dummies_2018.pdf
    • https://s3.amazonaws.com/sefipa/google_sheets_for_macbook.pdf
    • http://vurorevebosexu.rf.gd/53193768411.pdf
    • http://tagutibebik.rf.gd/pokemon_emerald_walk_through_walls_hack.pdf
    • https://uploads.strikinglycdn.com/files/d33859c8-c2b4-49d6-957b-e2a8b7e1b38f/napowujikoji.pdf
    • https://uploads.strikinglycdn.com/files/09aa3148-72a9-48e8-b81e-ba798502ec99/35110939311.pdf
    • https://uploads.strikinglycdn.com/files/256c7618-747e-47c9-b8d7-5b42989fa517/how_to_avoid_gas_during_yoga.pdf
    • http://wudobew.epizy.com/a_murder_is_announced_play_plot.pdf
    • http://nidikofuwovi.rf.gd/tepavofivu.pdf
    • https://uploads.strikinglycdn.com/files/fc15f5b0-49e7-4e31-aa63-ce81a8993f47/17168656723.pdf
    • https://s3.amazonaws.com/zarusegibitumet/how_to_clean_keurig_mini_water_reservoir.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef33.bin
a040f0e55759762b81bb9e3abde4960fa56d8c6652cb8d3df26d511a32c2dc82		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF33 5300 bytes
font_01_sfnt_off00010125.bin
fab80ad4baf015b76ffd63502a40d7bd7fc753261db554efd71c48ec449cd383		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10125 11836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.