Malicious PDF — malware analysis report

Static analysis result for SHA-256 0db38cce447ebf46…

MALICIOUS

PDF

93.6 KB Created: 2021-04-25 00:02:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c3c9ad5591dce3592ad261a5f1f70e0 SHA-1: 978eb4da2bbffe80d9852c95f8fb79eedad21a37 SHA-256: 0db38cce447ebf46dfa4d77e5052575048be4ffe75f2ad1fd1435ad154538dcf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO manipulation tactic. The primary external URI, https://xajibur.ru/strik?utm_term=kamasutra+book+free+pdf+download+in+hindi, indicates a lure to download content, likely to distribute malware. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=kamasutra+book+free+pdf+download+in+hindi
    • https://cdn-cms.f-static.net/uploads/4489734/normal_5fd09f688d96c.pdf
    • https://static.s123-cdn-static.com/uploads/4423714/normal_5ff44751f0c3d.pdf
    • https://cdn-cms.f-static.net/uploads/4450421/normal_606a83e404553.pdf
    • https://cdn-cms.f-static.net/uploads/4383702/normal_602c57bd26557.pdf
    • https://cdn-cms.f-static.net/uploads/4473384/normal_60127974a2893.pdf
    • https://cdn-cms.f-static.net/uploads/4393183/normal_60582921349f9.pdf
    • https://cdn-cms.f-static.net/uploads/4407664/normal_6061577801bea.pdf
    • https://static.s123-cdn-static.com/uploads/4413469/normal_5fce98bde29f8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://ac25a69f-a984-4293-9c3d-8c9e0f062535.filesusr.com/ugd/cbf077_6419a6a6999a464597fccb232914d9d4.pdf?index=true
    • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_85e8eec8904e4279899aa6adad12a89c.pdf?index=true
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_fa2b5aa174564e7cb69938d208f12e6a.pdf?index=true
    • https://5405d108-7f1e-482b-a10c-e06f62b7505d.filesusr.com/ugd/d941b1_c9e03de0b3cb488b975b0488c0e7eaac.pdf?index=true
    • http://duzebufulumaw.epizy.com/amcor_dehumidifier_manual_dc800.pdf
    • https://uploads.strikinglycdn.com/files/9e547e86-197f-41fb-a0e4-8240014aeabc/what_are_the_functions_of_golgi_apparatus_in_points.pdf
    • https://uploads.strikinglycdn.com/files/c094577c-aa65-42fe-b04a-33a7b276d95b/8121524106.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e26c.bin
43c81f8ed50b85de26a6ff206e55ebdea6790b2dad39da3f4e252043f21b81a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE26C 5548 bytes
font_01_sfnt_off0000f523.bin
9d32252858d52816b0822875fd7db6a9c2728712aa6e14c5ce467fc86adfb8bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF523 2752 bytes
font_02_sfnt_off000100bb.bin
b91f3c26f37c28538ed09035cbea6f9221827f1e30b50c452f08cc820bcc167b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100BB 3720 bytes
font_03_sfnt_off00010c1e.bin
672674ef5f50e093d48fe1a1220acac7fe1974c8e747eeeca26dec494553c300		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C1E 11208 bytes
font_04_sfnt_off000131f2.bin
90518ca7e605c148e94bc17d9ea4d7549777ba29ddf572df6deb86868225552a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131F2 16488 bytes
font_05_sfnt_off000148b5.bin
84151946ab3b7dd9d083289f05b39604640bf3863c76ae05c60f4723526642ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x148B5 9608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.