Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b987132db2ac228…

MALICIOUS

PDF

72.5 KB Created: 2021-03-12 14:47:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4b6a151fde123bf27f292c613dc37af2 SHA-1: d979d9c4f566b7ec2901112c703c2bf4d98314f2 SHA-256: 5b987132db2ac228c2c43957ffa1f1c356481cdad80de4120650851c816c78d4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a large number of external links, identified as a PDF link farm, with a primary malicious URL pointing to 'xajibur.ru'. This heuristic, combined with ClamAV detection and ML classification, strongly suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf', indicating it was likely generated programmatically to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=the+bands+of+mourning+audiobook
    • https://cdn-cms.f-static.net/uploads/4482848/normal_601152ef268c8.pdf
    • https://cdn.sqhk.co/diwamukef/jghJfhb/daytona_international_speedway_hotels_nearby.pdf
    • https://cdn.sqhk.co/rezejigobip/schbjco/guide_to_mounting_tv_on_wall_height.pdf
    • https://cdn.sqhk.co/saboxiwago/ozidyje/45493447188.pdf
    • https://cdn-cms.f-static.net/uploads/4487192/normal_601c7d461af74.pdf
    • https://cdn.sqhk.co/zubejavaxuvu/yywiihj/dujubifobikezavad.pdf
    • https://cdn.sqhk.co/godezixibufo/jajd5jg/nakulagoxivukaduduwepovuw.pdf
    • https://cdn.sqhk.co/kopenanum/gdibL1N/20798125259.pdf
    • https://cdn.sqhk.co/golemejexeno/gtQiizC/lukiturikesabotiperu.pdf
    • https://cdn-cms.f-static.net/uploads/4416939/normal_60421beda6428.pdf
    • https://static.s123-cdn-static.com/uploads/4465539/normal_5fc6d8ce2cb08.pdf
    • https://cdn.sqhk.co/zixifazod/Ygghjge/cake_dowel_cutting_tool.pdf
    • https://cdn-cms.f-static.net/uploads/4412387/normal_6046e8584214a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fixararololu/h_m_bed_linen_size_guide.pdf
    • https://s3.amazonaws.com/kuxuxemu/dekogopezezimugu.pdf
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_836298fdb29b4076bcafc384cc18e390.pdf?index=true
    • https://s3.amazonaws.com/teximikamukubo/convert_mp3_to_midi_file_audacity.pdf
    • https://bb55feb6-a0c4-48ae-8f72-aea2c45912f8.filesusr.com/ugd/b9801a_1f47949a37634886a95992b9a9a70feb.pdf?index=true
    • https://s3.amazonaws.com/vobuturinivi/android_studio_bundle_tool.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df1d.bin
75f15d3421d3a3b3837e0918a76ea999fef2f9155f934ff5d2c5c7b1ed0f44ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF1D 5444 bytes
font_01_sfnt_off0000f173.bin
469b46be540c244b883fdf1312ad2f186e8e34fa780366a48dfe97f26368c800		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF173 10388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.