Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e914c22655e9b8d…

MALICIOUS

PDF

81.0 KB Created: 2021-03-28 13:41:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: e7d4c6f620163844e692bdcd26d2ea23 SHA-1: 99cae6b4a57a904cbe886aeb63b1d58b696ab2e9 SHA-256: 9e914c22655e9b8d45f05e430e5faea5899ebaf6f2078313ea1193961429829d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one pointing to 'xajibur.ru', suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing lure, likely using a popular media reference to entice clicks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/123?utm_term=harry+potter+1+movie+free PDF link annotation
    • https://norusukesalija.weebly.com/uploads/1/3/4/3/134356509/9052071.pdfIn PDF document text
    • https://vokipokulolobu.weebly.com/uploads/1/3/4/0/134016984/najulinuz.pdfIn PDF document text
    • https://wikexedijul.weebly.com/uploads/1/3/4/6/134659224/4373546.pdfIn PDF document text
    • https://sozatoma.weebly.com/uploads/1/3/4/4/134484551/kazofomujatudi-julirakitasav.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/polojuliragam/35328920089.pdfIn PDF document text
    • https://s3.amazonaws.com/gizonukorad/josejeraworesatogak.pdfIn PDF document text
    • https://s3.amazonaws.com/mefovu/how_to_program_comcast_remote_to_magnavox_tv.pdfIn PDF document text
    • https://6997f972-013f-4c6f-ac95-4179ba17a557.filesusr.com/ugd/549e1a_78e4cfedce2e401db7f493079db2b5ca.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/titugome/aptoide_for_pc_windows_10_free.pdfIn PDF document text
    • https://s3.amazonaws.com/febopa/dsssb_warder_exam_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd65c2b0-d246-4fe0-820b-b0f9d8100320/ashton_drake_baby_dolls_katie.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/wobilepotanuvonuzanajas.pdfIn PDF document text
    • https://s3.amazonaws.com/febopa/latex_bibtex_cite_report.pdfIn PDF document text
    • https://s3.amazonaws.com/xipavir/allu_arjun_latest_movie_ringtones.pdfIn PDF document text
    • https://s3.amazonaws.com/rabewiruzitewa/95346929780.pdfIn PDF document text
    • https://21319658-e817-4d6a-846f-872ccfe0f0c2.filesusr.com/ugd/982af2_955d68c209e5435f81cfcd0c5c00184c.pdf?index=trueIn PDF document text
    • https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_7289594b3afb4ca496cfaf29e9d46627.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jofunozuzof/56954991373.pdfIn PDF document text
    • https://s3.amazonaws.com/defujo/index_match_return_multiple_values_google_sheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6840fa98-3115-4cc6-a8b0-4a53e61eb72f/how_do_you_make_a_baby_toga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4ce2ce1-f5df-4e44-b4be-16272127d97c/par_quoi_remplacer_la_fve_dans_la_galette_des_rois.pdfIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/how_to_tell_when_my_mossberg_500_was_made.pdfIn PDF document text
    • https://f72e0e13-a873-49c5-9cb5-3c2848b8c5b2.filesusr.com/ugd/f8ba4b_507439f14019437780beae766c355a5f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9efa0faf-c6f7-422d-970e-b5c1ac32441f/18225905387.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fdd1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDD1 5012 bytes
SHA-256: 236c62cb898942119a2ff10b71b3539b990529f64e060e18d933e43835b9fb50
font_01_sfnt_off00010ee2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EE2 11160 bytes
SHA-256: 79139434e51c59a147641e3adbc55de18a11cb52ceaa3d804e4e17b5e3722b35