Malicious PDF — malware analysis report

Static analysis result for SHA-256 c26be61b1c6a9e21…

MALICIOUS

PDF

79.4 KB Created: 2021-04-19 03:44:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7350706096b115813b82b2e52cfee19a SHA-1: d78c7d9ac3ac2e72341627d34837675b2c5368d6 SHA-256: c26be61b1c6a9e21548a3715dddb618fde2ce4a2d84c6b2bc148d8948d8e7c6a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://xajibur.ru/strik?utm_term=kill+team+movie+netflix', which is likely a phishing lure related to a popular movie. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, further supporting the idea of a web-based lure. No scripts were extracted, but the presence of external URIs suggests the document is designed to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=kill+team+movie+netflix
    • http://mekujoviwe.mypressonline.com/paxibe.pdf
    • http://wotukujis.sportsontheweb.net/astrology_book_in_gujarati.pdf
    • http://manuximaxemeje.scienceontheweb.net/bible_commentary_on_the_book_of_genesis.pdf
    • http://idealica-ordina.site/gokipukaviknnct8.pdf
    • http://jidogirikar.mygamesonline.org/xusuximikufiji.pdf
    • http://midarujiwuvi.mygamesonline.org/ceh_v9_certified_ethical_hacker_version_9_practice_tests.pdf
    • http://laxana.ru/kafepupixikitn4ayj.pdf
    • https://nidimojisojetuz.weebly.com/uploads/1/3/5/9/135962904/2843059c2598fe.pdf
    • https://nivirijimukavut.weebly.com/uploads/1/3/2/6/132681164/gopitoj.pdf
    • http://kyponnik.online/mazak_online_manualshbdsz.pdf
    • http://kopogaxepaku.sportsontheweb.net/60142113379.pdf
    • https://tojemevu.weebly.com/uploads/1/3/1/3/131384016/5148218.pdf
    • https://cdn-cms.f-static.net/uploads/4492257/normal_606b6149efd62.pdf
    • https://jabesukugadipo.weebly.com/uploads/1/3/2/8/132814964/lupijasutofujeb_nedujed_vesiboj.pdf
    • http://vulgargirls.fun/wuraxajojufuz3bahz.pdf
    • https://kosukanawator.weebly.com/uploads/1/3/5/3/135304621/balorujajesufi.pdf
    • https://bawosizegidaw.weebly.com/uploads/1/3/1/4/131411147/bfb231030f1f9e3.pdf
    • https://static.s123-cdn-static.com/uploads/4409113/normal_5fec17c27c2ad.pdf
    • https://sugasukeni.weebly.com/uploads/1/3/4/8/134878852/559ecd.pdf
    • http://passive-income.ru/aspiracin_de_secreciones_por_traqueostomaiwr95.pdf
    • http://zakosemej.mypressonline.com/diwipejudogebe.pdf
    • https://cdn-cms.f-static.net/uploads/4474719/normal_60566e20260af.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://vekisofekibote.myartsonline.com/livre_apprendre_le_franais_gratuit.pdf
    • http://neloralo.myartsonline.com/plant_cell_wall_structure_and_function.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecd2.bin
6deae5455da68c168824c6bf4f5eda3e05fa0ee24b62433834d491cab2bbc092		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECD2 4524 bytes
font_01_sfnt_off0000fc22.bin
f850a3e8d1aea7bf7ec4da9077bf088346751c5f9cc27faad3c4771c1ba056c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC22 11276 bytes
font_02_sfnt_off0001222b.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1222B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.