Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb8a6b334397a15c…

MALICIOUS

PDF

83.3 KB Created: 2021-05-27 07:21:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95e640c0d42beb62e7ac9cdcbf1334ca SHA-1: 26469f83e796d305d665eef3c16af478d1ecf13f SHA-256: fb8a6b334397a15ce0ddfa00430ede82632b3b956871b8f3d13fcca06dff708b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a significant number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The primary URL, 'https://zajinet.ru/strik?utm_term=self+defeating+behaviors+worksheets+pdf', suggests a phishing or malicious redirection attempt. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', reinforcing its malicious nature. No scripts were extracted, but the extensive link farm indicates a likely attempt to direct users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=self+defeating+behaviors+worksheets+pdf
    • https://kugakisan.weebly.com/uploads/1/3/4/3/134390280/14472.pdf
    • https://cdn-cms.f-static.net/uploads/4372358/normal_601fd806d7966.pdf
    • https://jasunibimagimuf.weebly.com/uploads/1/3/4/7/134733129/71b0a3e4cdd7.pdf
    • https://wutuzorul.weebly.com/uploads/1/3/5/9/135963099/fdb026e1.pdf
    • https://cdn-cms.f-static.net/uploads/4489247/normal_5fd7873e27bfb.pdf
    • https://static.s123-cdn-static.com/uploads/4499635/normal_60059afce1ef1.pdf
    • https://static.s123-cdn-static.com/uploads/4471479/normal_5ffdd0f27b71d.pdf
    • https://nogapixefakul.weebly.com/uploads/1/3/4/5/134590999/konivuredazevuxula.pdf
    • https://moremutinujiti.weebly.com/uploads/1/3/4/8/134865562/jijewe.pdf
    • https://cdn-cms.f-static.net/uploads/4500669/normal_60371980222b3.pdf
    • https://static.s123-cdn-static.com/uploads/4463279/normal_5ffc165d0179a.pdf
    • https://cdn-cms.f-static.net/uploads/4448995/normal_604e2d4a82ee8.pdf
    • https://cdn-cms.f-static.net/uploads/4384308/normal_603b4dd049cc1.pdf
    • https://zagefejov.weebly.com/uploads/1/3/2/7/132710748/noketepanek.pdf
    • https://jubabanijawema.weebly.com/uploads/1/3/1/0/131070146/252855affcd5f.pdf
    • https://funiduned.weebly.com/uploads/1/3/4/7/134773133/sapemixepuv-sososebagawa-muzepa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/71cd8711-706e-409a-88dd-b955c15fe06a/the_lorax_book.pdf
    • https://uploads.strikinglycdn.com/files/ceb9d5ed-7ed0-455a-a635-a206bc0f9481/18065912523.pdf
    • https://uploads.strikinglycdn.com/files/77e958b4-1b20-49ff-ac27-de30ddce3e08/movimiento_rectilineo_uniformemente_acelerado_ejemplos_en_la_vida_cotidiana.pdf
    • https://uploads.strikinglycdn.com/files/a626ed6a-6454-446a-98f3-e28d37e0f33d/a_street_cat_named_bob_age_rating_uk.pdf
    • https://uploads.strikinglycdn.com/files/e060a432-30d5-411b-a9a5-e0d60de146bf/55601232323.pdf
    • https://uploads.strikinglycdn.com/files/b679531f-d0b1-4ead-b5e6-2f7de23163c8/ldc_2017_previous_question_paper.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106a3.bin
171f0b9d1844710b2fa7126279d338c0d79c0f07eb04caecb3c2874ac79398b8
pdf-font-stream PDF embedded font (sfnt) at offset 0x106A3 5760 bytes
font_01_sfnt_off00011a4d.bin
a64fa476f1ba0ebdd4c8f149658a6a672abc0ddbb53cb875fe6169e268ef3d31
pdf-font-stream PDF embedded font (sfnt) at offset 0x11A4D 11000 bytes