Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a881aca1addc8ff…

MALICIOUS

PDF

78.4 KB Created: 2021-03-28 01:32:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 8678e8db8900d97a728f61a3c8cc2c71 SHA-1: cb9592c0736efc7eb7b3e1ed408f8911c4c4dbe7 SHA-256: 7a881aca1addc8ffec5253f050cbd244b4b97811754a46268d7b279616eebf5e
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of numerous external URIs, including one pointing to 'xajibur.ru' with a query parameter suggesting a spreadsheet, strongly suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a social engineering tactic to trick users into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/123?utm_term=employee+attendance+tracker+spreadsheet PDF link annotation
    • http://nafewid.sportsontheweb.net/jasivokolimadake.pdfIn PDF document text
    • http://sale50.pro/597812401079lczy.pdfIn PDF document text
    • http://rebibedo.mywebcommunity.org/tamoguwitobaxewilo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459326/normal_6054209b33e74.pdfIn PDF document text
    • https://cdn.sqhk.co/wozovege/hEgf7ha/odd_eyes_dragon_price.pdfIn PDF document text
    • http://theboldpantsproject.com/racing_go_kart_engine_partsphd50.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412757/normal_60329a1528589.pdfIn PDF document text
    • http://lokotahas.ru/visarebulodiponifi7co1m.pdfIn PDF document text
    • http://jovefupe.mywebcommunity.org/extreme_ownership_free.pdfIn PDF document text
    • http://igonlinesupport.com/tipping_point_malcolm_gladwell_amazon4xgzk.pdfIn PDF document text
    • http://rajukilodagoje.mygamesonline.org/rational_function_word_problems_with_answers.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501961/normal_604672e872d98.pdfIn PDF document text
    • http://suziterunedoloj.sportsontheweb.net/19788974106.pdfIn PDF document text
    • https://cdn.sqhk.co/ronuwimo/dO67ie4/openttd_wiki_local_authority.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://8f6f9f04-f977-4239-955d-f6aecf2dd879.filesusr.com/ugd/81cd61_81089c352a2c469b932d32fcc8333765.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mixanaz/71460588681.pdfIn PDF document text
    • https://4461694d-a6f7-4a69-895a-ff5ddeb3c622.filesusr.com/ugd/f504fb_bc72a65547f44c34b459b21edd08c72a.pdf?index=trueIn PDF document text
    • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_c110cd5209c34d7c9043e106e6f8aa35.pdf?index=trueIn PDF document text
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_248dea49d859484fb80d280e7b6a8528.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xotomisen/basketball_arcade_game_mod_apk.pdfIn PDF document text
    • https://cdfb6f36-dde2-4af5-b3b7-55ff39976061.filesusr.com/ugd/c6ac46_6e9fa5630ca4479a87a0e2080ac85fe6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gadumagabusodel/nufolaliwilijujid.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6C4 5436 bytes
SHA-256: cc79248d281cc33fcd9b9b5937ccc12af4e5f64a6d5fb2fea32e78afc341d099
font_01_sfnt_off0001091d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1091D 10176 bytes
SHA-256: 7f2e907a9a34876ff3b462fdddd774bc5e14221a2eb636a2ec38a5b7a860e636

Open this report in the interactive analyzer, or submit your own file for analysis.