Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcc5d55adf8f5e20…

MALICIOUS

PDF

80.7 KB Created: 2021-03-20 03:45:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 84f87522ee1be8db487da98fed0c4c03 SHA-1: 20fe20fd1a52f2dfb15db19858006bd0915e9693 SHA-256: fcc5d55adf8f5e20c3c4b1767ff799d6863091a97a3598ed2a982af361653bde
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of embedded URLs, including one pointing to 'zajinet.ru', suggests a phishing or malware distribution attempt. The heuristic 'SE_LOLBIN_RUN_COMMAND' also indicates suspicious command-like sequences within the document text, further supporting the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=old+time+religion+bioshock
    • http://tefitagesev.mypressonline.com/terut.pdf
    • https://cdn.sqhk.co/parabeset/jjPEMXK/10700589814.pdf
    • https://cdn.sqhk.co/xevowuto/jIiiRnJ/hashtags_for_tiktok_fyp.pdf
    • https://cdn.sqhk.co/purorelaz/iigheXf/61025650228.pdf
    • https://cdn.sqhk.co/sebutarukaw/gfKEvhj/58237267450.pdf
    • https://cdn.sqhk.co/zotipimesaza/T9Iu0k9/62207289291.pdf
    • https://cdn.sqhk.co/lolumebitana/augLThn/teach_on_mars_blog.pdf
    • https://cdn.sqhk.co/juwafajem/IcRugdW/lijowilavekos.pdf
    • http://kasaxeko.mypressonline.com/29807387891.pdf
    • http://libopadu.scienceontheweb.net/billy_sims_bbq_menu.pdf
    • https://cdn.sqhk.co/kukisigafumi/jTBNu9h/new_york_city_tours_packages.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1d3fdc26-e5fc-4ed6-b132-0a01622023d3/how_to_do_a_body_wave_curl.pdf
    • http://dijuvunote.onlinewebshop.net/yamaha_mg10xu_usb_interface.pdf
    • https://s3.amazonaws.com/geradi/bomuraforozevusujuk.pdf
    • https://s3.amazonaws.com/dinigugaxej/74783744813.pdf
    • http://fidikaxano.myartsonline.com/16936516621.pdf
    • https://s3.amazonaws.com/godoremitiwuja/63702489999.pdf
    • https://uploads.strikinglycdn.com/files/5ebc570a-6b01-433d-98a9-43c3d1cc489c/tasosojegukul.pdf
    • https://uploads.strikinglycdn.com/files/3fedffad-72bc-45a6-af8f-3f612b62e591/how_to_turn_off_self_cleaning_oven.pdf
    • https://s3.amazonaws.com/sowewazulejewi/gooners_guide_la_liga.pdf
    • https://s3.amazonaws.com/ziwuvijevo/club_car_precedent_enclosure_installation.pdf
    • https://uploads.strikinglycdn.com/files/5da877e7-525d-4a87-8b6b-7d79ef8785a7/voruzikugazozage.pdf
    • https://uploads.strikinglycdn.com/files/06c65654-ad62-40a4-ab39-9d95ea552ed0/what_age_baby_einstein_jumper.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc78.bin
d726deb9f0a7f1c96492548122a7b3ec439e2bfd2c1b6532795cdd94e83c85e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC78 5376 bytes
font_01_sfnt_off00010e8f.bin
d3d7ccc3cc817ed99b36a51f8b8c49879ff458512b35e7ed32faa39b73deb698		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E8F 11496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.