Malicious PDF — malware analysis report

Static analysis result for SHA-256 51df44cf71dda8a2…

MALICIOUS

PDF

80.0 KB Created: 2021-03-21 20:50:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: e4b797bfe3252db8b35e1731d9c0dbfd SHA-1: a013791e70f6c09fddd60ef1d067b133b6f5f1c9 SHA-256: 51df44cf71dda8a2651fd1aa7eb1d51063fe70fbfbad8bd3f0996a32411fac7c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains numerous external links, with one prominent URL being https://xajibur.ru/strik. The presence of embedded URLs and the file's structure point towards a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=sole+e35+specs PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4393044/normal_5fcff5bc30262.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370078/normal_602f8805cad88.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392857/normal_6025c6991f6d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471475/normal_603062b9c9e16.pdfIn PDF document text
    • https://xudomulur.weebly.com/uploads/1/3/4/0/134040538/nazafaro.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485442/normal_5fc9c4356e992.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423145/normal_6025187ed859a.pdfIn PDF document text
    • https://nedidibizexoba.weebly.com/uploads/1/3/0/9/130969065/e2c8729456.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385869/normal_5ff5ef79271d0.pdfIn PDF document text
    • https://purelukanixavaj.weebly.com/uploads/1/3/1/4/131454065/xerokepawiwoxel-sinuzazebiwugo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413458/normal_603fc6b7af752.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415770/normal_6032caac0a115.pdfIn PDF document text
    • https://tolubezilonis.weebly.com/uploads/1/3/5/3/135348590/cfc588256d2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://ea7788ad-ef5a-48b5-911d-3ad522045378.filesusr.com/ugd/f3bfbb_f916358ce1ad4f7792ec98b1915a970c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zasepo/android_pie_vs_android_10.pdfIn PDF document text
    • https://s3.amazonaws.com/wixanarer/76205170620.pdfIn PDF document text
    • https://s3.amazonaws.com/kewakuko/kaxopewojalometelazolerip.pdfIn PDF document text
    • https://s3.amazonaws.com/redegelesibif/nadujige.pdfIn PDF document text
    • https://s3.amazonaws.com/roxawo/autobiography_of_apj_abdul_kalam.pdfIn PDF document text
    • https://d86ad34a-7df2-4f47-937b-a12ab5abc0fa.filesusr.com/ugd/8cbfce_80cdb33270614361bea83803bf341752.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/libowebujakux/15048564053.pdfIn PDF document text
    • https://s3.amazonaws.com/pasutiz/what_is_the_best_diagnostic_tool_for_pulmonary_embolism.pdfIn PDF document text
    • https://af0fe010-594a-4ec7-a26b-e2d78e33490d.filesusr.com/ugd/7d2910_1cf10a3e7b09446da18f20cc27d50ed3.pdf?index=trueIn PDF document text
    • https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_3c7240fb8e024842b80798c12febd5a4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rubidokezive/the_chronicles_of_narnia_the_silver_chair_2020.pdfIn PDF document text
    • https://2903667b-e544-4972-ac7f-e5855aaa9b37.filesusr.com/ugd/2cc660_53b53f42e0a14bbd97f9ef1c81c70f01.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jenagubadopi/audacity_of_hope_speech_analysis.pdfIn PDF document text
    • https://s3.amazonaws.com/bovenotojitowe/kalabejupupavodola.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA70 5012 bytes
SHA-256: bc5bd570f7d1113ae6f48bebba4ced75d098a743455fbd5f07d06a69e436baa6
font_01_sfnt_off00010b9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B9B 10888 bytes
SHA-256: a43a87f710caf14d6d4c2f84a5fd6d4655863cfdbad7f27c3d81c60640224679

Open this report in the interactive analyzer, or submit your own file for analysis.