Malicious PDF — malware analysis report

Static analysis result for SHA-256 c127535ed1727f9b…

MALICIOUS

PDF

75.0 KB Created: 2021-03-01 19:07:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 9ba8c9400520c112e7fb5613536f9695 SHA-1: 879228ddbcc31a228527ba215d778a470858b721 SHA-256: c127535ed1727f9b9e96a8d1d4c790ac5e732897b13ecbb12f4de0b17133ed60
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'xajibur.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to a game walkthrough, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/aws?utm_term=super+mario+bros+wii+walkthrough+world+2 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4479237/normal_5ffe92761f714.pdfIn PDF document text
    • http://bitcoinlearningcentre.online/xafumimi1f119.pdfIn PDF document text
    • http://site-shop.xyz/schlage_keyless_door_lock_not_working1x315.pdfIn PDF document text
    • http://ujjjrrrrr.space/posulujunexejofijufift0cp6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414334/normal_5fcd2f96a5cfc.pdfIn PDF document text
    • http://strapslap.online/manualidades_de_halloween_para_nios_fciles9mzde.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411944/normal_5ffbdd40051b1.pdfIn PDF document text
    • http://kittyplay.online/how_to_cancel_rental_agreement440wb.pdfIn PDF document text
    • http://shop-onlinediscount.xyz/begin_again_mona_kasten_espaol9fo9h.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376105/normal_6010fd7e7b401.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384316/normal_601ba6e08758b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/the_game_rapper_born_2_rap_tracklist.pdfIn PDF document text
    • https://s3.amazonaws.com/xelimewat/download_driver_may_in_brother_hl-2240d_win_7_32bit.pdfIn PDF document text
    • https://s3.amazonaws.com/lovomijelun/27867470968.pdfIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/binomische_formel_bung.pdfIn PDF document text
    • https://s3.amazonaws.com/rimejiguvif/game_spotlight_room_escape_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/zifilobesumafi/veruveva.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e372.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE372 5904 bytes
SHA-256: 8bdc5741e7a2ef382f3b4ca72c91ea8d59926c4dd74b2bb6f78b2ee84acf3481
font_01_sfnt_off0000f765.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF765 12048 bytes
SHA-256: f6f2963b5a674311d3714b55639cccba54fe2bf0454edce6e14003cf27b900ad

Open this report in the interactive analyzer, or submit your own file for analysis.