PDF malware analysis — malicious · 3bcdf7a5714434b5

MALICIOUS

PDF

86.2 KB Created: 2021-03-13 12:53:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07

MD5: 78f0e3538883dd955ef44f2c312ab3c4 SHA-1: 839c918480f75778d3fdb31c364f6a954bc54484 SHA-256: 3bcdf7a5714434b5d7dab6addad09c9def9a3a34dd78aabeafb6a67d0b15ea6d

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and an ML classifier indicated a high probability of maliciousness. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or redirection mechanism. One of the primary external links, 'https://xajibur.ru/123?utm_term=react+cheat+sheet+lifecycle', is likely the intended destination for the user, potentially leading to a phishing or malware download site.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/123?utm_term=react+cheat+sheet+lifecycle PDF link annotation
- https://static.s123-cdn-static.com/uploads/4407084/normal_5fc7353703fcc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4496815/normal_5ff3c9cb0a672.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4485451/normal_5ffd75832181a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413846/normal_5fd9caaa2d3a0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4371244/normal_5ffccaf0d0504.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476766/normal_601db84182cc6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426696/normal_6000116f06fc5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4388819/normal_5fdfd6cab7372.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366622/normal_600e09dca94b1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370097/normal_5fd7509bc08b1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/969b9174-04d8-4907-ae94-775bb3b3fdf4/gulubiwusufiwirewifolaga.pdfIn PDF document text
- https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_37eca6b6833b4998b3c843cc51fb6e8c.pdf?index=trueIn PDF document text
- https://6e37e838-c278-4d46-baa9-25b8497af200.filesusr.com/ugd/fbcb80_9f098e88c61f4271a293ba1124458326.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lunojol/piwematatuguwamepofetofab.pdfIn PDF document text
- https://s3.amazonaws.com/donarepemi/statistical_methods_vs_machine_learning.pdfIn PDF document text
- https://s3.amazonaws.com/nawuvud/48851068397.pdfIn PDF document text
- https://f11c4bf2-12a6-49f8-9590-07a94b689168.filesusr.com/ugd/11276f_8106e504a20240878a32ec20c6209d80.pdf?index=trueIn PDF document text
- https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_a905be8bd1334a1f9feadaf57e1bb5be.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/baritexovopa/akasam_ammayaithe_ringtone_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0b83fd27-f428-454a-8983-060d2c95e7d7/30288953751.pdfIn PDF document text
- https://30cc9e9c-6145-4029-bfdc-d0561bdb3a10.filesusr.com/ugd/0dcf4b_aa8a21ca83104b449755f8835407fd8d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f3113630-cf6f-4800-8a25-687ada95cbc6/jipeduwiviwitowalo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fbf9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBF9	4980 bytes
SHA-256: `5bdaa8e0e95cea97c05e98b2eac181b51ad230906a04f286f6324bb2e155ddb4`
`font_01_sfnt_off00010cfc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10CFC	11944 bytes
SHA-256: `d9e6b54d6143bb4364bdcbe0b686975ec1cfe446fdf012732d6b41b9dd254a3e`
`font_02_sfnt_off0001360d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1360D	16164 bytes
SHA-256: `4b52fd5da643d9c08cc0a86f773b2f024e3274f3f861dfcac100db1ef433cf06`

Open this report in the interactive analyzer, or submit your own file for analysis.