Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a1bdfd3e9096e80…

MALICIOUS

PDF

76.0 KB Created: 2021-04-19 14:51:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: a665afea774043032220a03d9779c2af SHA-1: aa4dccb7366d0f5fabef72dba1cb8c5a663ee791 SHA-256: 0a1bdfd3e9096e800c28f49706279a883a99c493f628a4425167942c87ac1183
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which point to disposable hosting, suggesting a link farm designed to manipulate search engine results. One of the primary URLs, 'https://xajibur.ru/strik?utm_term=digital+marketing+average+salary+in+us', is likely used to redirect users to malicious content. The presence of ML and ClamAV detections further supports its malicious nature, likely as a phishing or redirection lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=digital+marketing+average+salary+in+us PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4490251/normal_600be799b9784.pdfIn PDF document text
    • https://cdn.sqhk.co/xezexasag/phaonN4/xaxevanuxajojelet.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476593/normal_606ca3d19a587.pdfIn PDF document text
    • https://cdn.sqhk.co/rufomezin/e3txhhf/claim_missing_money_california.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390681/normal_5ff0d1a051310.pdfIn PDF document text
    • https://cdn.sqhk.co/bidogefapo/RhghcI5/kibowovowelagufukubi.pdfIn PDF document text
    • https://cdn.sqhk.co/losokifape/ffij3je/among_us_character_red_with_devil_horns.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393483/normal_5fe81c998f35a.pdfIn PDF document text
    • https://cdn.sqhk.co/nunamarajop/R3jgjur/72391879677.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/67ded358-c623-476d-a61b-7d20943cc94a/37505555875.pdfIn PDF document text
    • https://f733e552-90a1-4d1f-83ca-a6b36afcf31c.filesusr.com/ugd/38bf1f_d265d70719f846829981a5f8c9d55cf9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4cadcb2e-9ade-4b11-b397-b3a831b1acb7/how_to_calculate_nerve_conduction_velocity.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6dc7fb2e-cf88-4c99-b0cd-cc75eb63b8fb/6419053023.pdfIn PDF document text
    • https://e1bd05e7-a2ed-43df-b5fc-9bc8ee0b1a84.filesusr.com/ugd/08acf3_4bf4834216d64864868045523a6eb5e9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f1790cd-f1d5-4f11-a666-48dc6e57a4dc/veluz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb2e1e76-be74-4cb2-919b-f6ff18f1ff5d/80388769102.pdfIn PDF document text
    • https://3c86e5df-9a55-47dd-9d5b-c207b25ec6cd.filesusr.com/ugd/72bf36_be1d2b2b7340489db1e152a45af3ddcf.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e3a1f53-9e7d-49e5-b112-e178296d6d50/are_technologies_gendered.pdfIn PDF document text
    • https://e40da922-b0e4-44be-9878-2d4898ccab21.filesusr.com/ugd/3a38e0_5da43ec6a64b49ab8fbefad885debcd9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/85b647d6-c5b0-4bc7-ac60-e0bad0ac7c3a/fleck_5600_water_softener_service_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/pukaridimupo/critical_and_creative_thinking_lecture_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/wofaxil/general_motors_brand_guidelines.pdfIn PDF document text
    • https://d9226533-59f4-4737-ae77-cfa9cdee5378.filesusr.com/ugd/d7c203_233d29ecae754ae4b5bffa70ccbc8136.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec87.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC87 5228 bytes
SHA-256: 3d3a4d1ec3d084ccf6c516e5201e99de754e5964758bcd8f6d9cf70222238d0c
font_01_sfnt_off0000fe54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE54 10504 bytes
SHA-256: 5fc77021839f0fcf162f11d2fdba3c486b43d1ba2d3503bb10b4e2b904b24899

Open this report in the interactive analyzer, or submit your own file for analysis.