Malicious PDF — malware analysis report

Static analysis result for SHA-256 6376306c2ccee07b…

MALICIOUS

PDF

76.7 KB Created: 2021-04-05 18:49:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: b8c86999fcf07c2aabc1edc17b3eafe8 SHA-1: 95a70f9ed240b93efcf18688703f9fa6b3f7383f SHA-256: 6376306c2ccee07bc7f5e2045fa6fb1a25f7842de0a49ce6fd41001cedef2d56
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF with a high ML classification and ClamAV detection, indicating malicious intent. It contains an embedded URI pointing to 'xajibur.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'Adele sheet music', aligning with a phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=adele+sheet+music PDF link annotation
    • https://cdn.sqhk.co/fegukajebaj/fUQ7RKG/map_of_cities_in_afghanistan.pdfIn PDF document text
    • https://cdn.sqhk.co/soxuvezosapa/dkiisCX/cool_castle_seeds_for_minecraft_pe_2019.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/eaea8733-1180-4948-b28b-fb4c547c08d3/rockwell_1794-ie8_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7feaf1bb-0325-46bb-84d6-379e37630f70/periwatenosazinitimule.pdfIn PDF document text
    • https://s3.amazonaws.com/nolarifaforuxop/kusurisosasibed.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/211b3abe-c354-4046-92b8-274c0f56fc15/husqvarna_445_starting_problems.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81fe5096-442b-4ef8-8c66-6829f794ef5d/bissell_3624_spotclean_pro_carpet_cleaner.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3bb99d6-d3b8-4727-bd42-bf82cfe0b806/kuwofomukivokap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d98325ef-3b09-40d8-9f7c-68c85ebe5fdc/cool_aa_meeting_topics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01800445-5bde-47d0-b256-235bd4a04a96/nolifiben.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5da36762-4df5-4e93-96c9-83b9bdde090c/how_to_create_a_cyberpunk_character.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15be1236-8279-455e-8c7a-f65ba77d487d/rilomugef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1538bc51-0db8-40de-a4f1-a17442bf31b3/roxerap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2bee3cd-3aab-43de-9d42-aba4197ddf92/sony_rx10_iv_price_philippines.pdfIn PDF document text
    • https://s3.amazonaws.com/xurixado/20374661906.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0bb155c-09a4-41b0-ac92-e5f362c392ec/data_analyst_certification_courses_in_bangalore.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d235b834-b0c3-44b0-b711-d655f82c8e1d/my_skyworth_remote_not_working.pdfIn PDF document text
    • https://s3.amazonaws.com/labitajaxatufib/60274525845.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aef21aa3-2c85-4ccd-a6f1-23f114351e42/words_that_start_with_eda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83ef021f-2c6c-4f53-ae69-99a442754ec9/wawofosu.pdfIn PDF document text
    • https://s3.amazonaws.com/pisik/5e_arcane_trickster_character_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4f4e657-8337-4aa6-9972-45488127544f/jack_lalanne_juicer_cleaning_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d282fc0d-6846-48c6-8375-7e7eb0926a48/80926890509.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f05b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF05B 4864 bytes
SHA-256: cd9919d012ffe74ed80fc6ab1251f5f224338673dcd1463f1bf65826b5bd0c51
font_01_sfnt_off000100c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100C1 10808 bytes
SHA-256: 65479d402d64a1268904048136922f447e6cc06f4995a9cd846030a5dda70234

Open this report in the interactive analyzer, or submit your own file for analysis.