Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffca5a9eb9e52d43…

MALICIOUS

PDF

78.1 KB Created: 2021-03-25 12:00:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 17eee131815c4d803c44cd819ef0ed78 SHA-1: 43d61d0ac4a6505b10b699dce3ce6412992372ba SHA-256: ffca5a9eb9e52d434ac3620552f2b8771a70d53f023a4225ac6899852dedda07
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. It contains an embedded URI pointing to 'https://zajinet.ru/123?utm_term=sql+server+2014+sp2+cu10', suggesting a phishing attempt related to SQL Server. Although no scripts were explicitly extracted, the PDF structure and the presence of embedded URIs are indicative of a malicious document, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=sql+server+2014+sp2+cu10 PDF link annotation
    • https://cdn.sqhk.co/kufagilan/cichaRE/hamster_life_hacks_troom_troom.pdfIn PDF document text
    • https://cdn.sqhk.co/wibetaxor/jeDT2BI/5418876475.pdfIn PDF document text
    • https://cdn.sqhk.co/xejudawadoni/juoCgcj/datimugofalov.pdfIn PDF document text
    • https://cdn.sqhk.co/lopovekis/YnYYijh/lino_cutting_sheets.pdfIn PDF document text
    • https://cdn.sqhk.co/vajirasavuz/McihjhJ/dips_academy_abstract_algebra_notes.pdfIn PDF document text
    • https://cdn.sqhk.co/wifilivemij/Tgc2Lii/12938871593.pdfIn PDF document text
    • https://cdn.sqhk.co/vanewano/argjH7U/fox_movie_theatre_wyomissing_pa.pdfIn PDF document text
    • https://cdn.sqhk.co/segenoliz/ghl0npV/20535221321.pdfIn PDF document text
    • https://cdn.sqhk.co/webuzifinuno/ihjujf0/cookie_cats_blast_mod.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sorogamat/fovigobipuw.pdfIn PDF document text
    • https://s3.amazonaws.com/ninasivol/52770172192.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f78dce0-0f8a-40cc-8ae6-16605f16a7a5/10825838202.pdfIn PDF document text
    • https://s3.amazonaws.com/pujirageg/jazez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5eb04bfb-0444-4303-a02f-c6e00d19c018/romeo_y_julieta_churchill_anejados_tubos.pdfIn PDF document text
    • https://s3.amazonaws.com/mevuzokekenojab/vomibuwesefij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfcc5c4b-42ac-43c1-bfa0-b628e5eeaa3f/cuisinart_bread_maker_costco.pdfIn PDF document text
    • https://s3.amazonaws.com/nijosinizo/35094030295.pdfIn PDF document text
    • https://s3.amazonaws.com/zomuzigo/carmelite_breviary.pdfIn PDF document text
    • https://s3.amazonaws.com/zuguvoxoki/gupigedapijunos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55360545-c142-4a83-b351-7702c7d7fd20/44163109279.pdfIn PDF document text
    • https://s3.amazonaws.com/bidurudilidujug/61052182615.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a4f17c1-ba4b-4522-8e2f-eed964c2d5ce/muwatesebonas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c7313fe-33ed-4e2c-8b9e-13edf2273fbc/jolemas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3C3 5420 bytes
SHA-256: 4f69980dbeedc6ad479c4c7b33a6847d1317943c13d2a3f82f1f9f534b6aa735
font_01_sfnt_off00010660.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10660 10756 bytes
SHA-256: d77134a14f50b46a4af07e20df5ca533d33bddac6a0456dcef2d1ad36cfabc6d

Open this report in the interactive analyzer, or submit your own file for analysis.