Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e77a080fcd61b24…

MALICIOUS

PDF

85.4 KB Created: 2021-05-30 02:52:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 0a3f796428264f0fdf4bfb28a6a8bef0 SHA-1: e57e286184bd80fa93caf27b9258089dcd8a396f SHA-256: 9e77a080fcd61b24f940b1ebae3a61ac1f64b29d81f7969050312d945c246249
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, many pointing to other PDF files, suggesting a link farm or redirection mechanism. One prominent URL, 'https://xajibur.ru/strik?utm_term=pack+natal+filmora+gratis', is embedded and likely serves as a lure to download further malicious content or engage in phishing. The document body is heavily obfuscated and unreadable, but the presence of numerous external links and the malware detection strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=pack+natal+filmora+gratis PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4367922/normal_5fe3e0b8ce781.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475000/normal_606e9306b2068.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480403/normal_5fcf47548ab14.pdfIn PDF document text
    • https://kipokemob.weebly.com/uploads/1/3/0/7/130738996/4836228.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408478/normal_5fcda40fc0187.pdfIn PDF document text
    • https://xitenewoz.weebly.com/uploads/1/3/4/3/134314294/xufezibuz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372963/normal_6013346110684.pdfIn PDF document text
    • https://wodaxudufusan.weebly.com/uploads/1/3/0/8/130814186/2973261.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412173/normal_6000aabe19244.pdfIn PDF document text
    • https://salapabozob.weebly.com/uploads/1/3/5/3/135326799/ce190c.pdfIn PDF document text
    • https://popewike.weebly.com/uploads/1/3/1/4/131407195/misagewagaxugaxiwon.pdfIn PDF document text
    • https://sanivuledaxefe.weebly.com/uploads/1/3/4/2/134234591/7482242.pdfIn PDF document text
    • https://kivijakesav.weebly.com/uploads/1/3/2/7/132740669/xarodunemavovutupula.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480884/normal_5ff1dd5782cb9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380223/normal_6012b05d9bfef.pdfIn PDF document text
    • https://vogitoroxubas.weebly.com/uploads/1/3/0/7/130739894/1264041.pdfIn PDF document text
    • https://teribizekejuxes.weebly.com/uploads/1/3/5/3/135391999/5910989.pdfIn PDF document text
    • https://minileponefij.weebly.com/uploads/1/3/1/0/131070526/4ca84c.pdfIn PDF document text
    • https://vizazoxo.weebly.com/uploads/1/3/4/6/134600102/fagipupopif-nisefux-kinezulinenugi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479718/normal_5fda395e5f155.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1ED 2900 bytes
SHA-256: 40ce0bc9b113ef031639604f059b60aa9f1e41b097d60e75bfbf620cccc66306
font_01_sfnt_off0000ec31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC31 5264 bytes
SHA-256: 55bbce1fe3a3d44e1d5d5940de7a605dd34981a74f4f8dcfd8f9a96bef068c13
font_02_sfnt_off0000fe0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE0C 23084 bytes
SHA-256: a114e958f0cd417a20e260a317c2c708e2be1020ade7cff7fc8a09dcd080e461
font_03_sfnt_off000130db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130DB 16092 bytes
SHA-256: 39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67

Open this report in the interactive analyzer, or submit your own file for analysis.