Malicious PDF — malware analysis report

Static analysis result for SHA-256 479b9841d34442b0…

MALICIOUS

PDF

99.7 KB Created: 2021-04-04 19:36:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: be72224a07eeff2a546c737e43b0b108 SHA-1: 99a7c5f8e46f38dc1513acdfc62a0eb780296d7a SHA-256: 479b9841d34442b0cd5650459dff37001cb5c1a67f97bc704df2b785736e940b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to PDF files, suggesting a link farm or SEO spamming tactic. The primary URL, 'https://xajibur.ru/strik?utm_term=how+and+when+to+do+istikhara', indicates a potential phishing or scam lure. While no scripts were explicitly extracted, the PDF structure and numerous external links are indicative of malicious intent, likely to redirect users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=how+and+when+to+do+istikhara
    • https://cdn-cms.f-static.net/uploads/4380522/normal_6028c426756cd.pdf
    • https://kufoxigokutef.weebly.com/uploads/1/3/1/8/131856815/xipajojizaru.pdf
    • https://dumunevebule.weebly.com/uploads/1/3/0/8/130874169/4982254.pdf
    • https://cdn-cms.f-static.net/uploads/4496607/normal_6039965c58cc0.pdf
    • https://juzatimeb.weebly.com/uploads/1/3/4/6/134605854/7007615.pdf
    • https://federadedeladol.weebly.com/uploads/1/3/4/6/134626130/e1d625e98.pdf
    • https://wenewemegidipep.weebly.com/uploads/1/3/4/6/134679414/zalokikusifezopi.pdf
    • https://cdn-cms.f-static.net/uploads/4495691/normal_5fe9108ac7f46.pdf
    • https://cdn-cms.f-static.net/uploads/4472188/normal_602220f9e8d1a.pdf
    • https://static.s123-cdn-static.com/uploads/4464525/normal_5febffb53aff5.pdf
    • https://cdn-cms.f-static.net/uploads/4412403/normal_5fdc8714150fb.pdf
    • https://vazatevetag.weebly.com/uploads/1/3/0/8/130874289/f933f2874.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a3de454e-1598-42bb-a259-4eb69c42f179.filesusr.com/ugd/fb5067_e0882b3311d14943a6b740418c89a428.pdf?index=true
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_0e42c4ddf9f74f4a847993513ce0e38e.pdf?index=true
    • https://d1ced4a1-fa29-4c66-b583-77209f32159a.filesusr.com/ugd/c88d8b_6562a67fc8bf428690f25caee061373a.pdf?index=true
    • https://23da7c74-6e14-424a-b22a-901aa35eafb1.filesusr.com/ugd/9cc572_7d15fa6780cc4db094bfba3ebfc3b986.pdf?index=true
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_1ca28344f933481db3a23858eecbbe0c.pdf?index=true
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_591255e2696e4e8ea064b0ceb9b4a84a.pdf?index=true
    • https://1a9cd40a-f0d6-44d4-a143-19288280ca2b.filesusr.com/ugd/7a13df_782eaaf89d2f40888fa706e3d451b3ef.pdf?index=true
    • https://e5720c39-3c1c-4a52-9be9-509675281b5a.filesusr.com/ugd/0010c8_65adafd08d8349d4a59b534f73c9ad26.pdf?index=true
    • https://c4647614-9ff8-4b00-b819-08dc938bd166.filesusr.com/ugd/5d3f24_97065d0b0ffe4d2497772fdafb7165ab.pdf?index=true
    • https://2dcb0092-dd22-4cef-90c1-8c398f802bb7.filesusr.com/ugd/ff3115_faf20d858c254642a970da6f3e6d295f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001515f.bin
e2d8c25525bd21dcc98b519544c769651c25437ad462582aa6eb6ad0646795f3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1515F 27468 bytes
font_00_sfnt_off00011ab7.bin
5422bb35aabe03a07f3e6d7b2dca582ab22086f6643794e414a38a802a02b5cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AB7 4996 bytes
font_01_sfnt_off00012bbc.bin
2d594214bf084f35ab37d9b8b4ca9a1455bc47e30c788c4d545e09e4cff73523		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BBC 11080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.