PDF malware analysis — malicious · efaa9794a6938895

MALICIOUS

PDF

85.6 KB Created: 2021-05-27 18:27:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: b840fa5c5e4d71b2640ccf701dd3d691 SHA-1: d71450371c70235ba62562100426f8c7e18b5e3b SHA-256: efaa9794a69388952ad6ce11804112f443ea3c57ef523304ec22b7f93ec0fbf8

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by both ML classification and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm used for SEO manipulation or phishing. The primary URL, 'https://xajibur.ru/strik?utm_term=free+download+amharic+english+dictionary+pdf', is presented as a free download, which is a common lure for phishing or malware delivery. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/strik?utm_term=free+download+amharic+english+dictionary+pdf PDF link annotation
- https://fulidozemupure.weebly.com/uploads/1/3/1/3/131384797/rewezuduzot.pdfIn PDF document text
- https://zufulakoloti.weebly.com/uploads/1/3/5/3/135301661/3063238.pdfIn PDF document text
- https://xogepojofaridel.weebly.com/uploads/1/3/2/7/132741214/5958778.pdfIn PDF document text
- https://xizotikozuza.weebly.com/uploads/1/3/4/5/134587863/xuwude_gipilunuzasagu_puwoletepaziji_mubowamuludo.pdfIn PDF document text
- https://bogixeguwumuzu.weebly.com/uploads/1/3/4/5/134503630/maxuvoloxe.pdfIn PDF document text
- https://gunubamevozapub.weebly.com/uploads/1/3/3/9/133997290/8a6f09755ab3ece.pdfIn PDF document text
- https://xebadaminel.weebly.com/uploads/1/3/4/5/134523447/miputafakixikix.pdfIn PDF document text
- https://joxeluduxena.weebly.com/uploads/1/3/4/7/134772203/mezodimipaz-xosibugav-gunijefudiruvat-tarileg.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3609a93a-0554-4c6b-b319-c7e0fad85d4a/how_to_define_twin_prime_numbers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cc6f2094-d148-4e4f-9c06-29d034a73891/84368552725.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a1a2be6-07cc-40d3-b3a9-031bb1fc6e4a/average_cost_of_living_per_country.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac107da1-9110-479e-af82-4e4f73de55eb/fujitsu_fi_7160_scanner_driver_download_windows_10_64_bit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/70c7e29c-deb7-4edc-a994-c59e853801fc/tomazevawivadev.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fd9ba593-c0cb-420e-b50d-b1656c5b532b/jeguropotidonatufinuga.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a86b0e4-c08e-450f-986f-5fb20ffbc829/74991461159.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cf3276f1-1ef4-4ec6-a5f4-21dd3b849b01/how_to_reset_smael_watch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7484c43e-d58c-4b82-95a9-793dda9d63f9/lukav.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3b1902f-633d-427d-bf07-f5e18e7be9ca/33762560700.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/975bf49d-5ba9-4ff0-9154-9ef1880afff6/african_american_history_museum_gift_shop.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f3dc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3DC	10872 bytes
SHA-256: `47b787f55223fb132ef452353ea94b541e13e003f64a8f2cbf184e89dbf08833`
`font_01_sfnt_off00011027.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11027	5716 bytes
SHA-256: `16a2104c013af63d88e9b524daf018fc4add7801a491fcb9bc1daa4733b32132`
`font_02_sfnt_off00012390.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12390	10828 bytes
SHA-256: `23d8832c88c9db76f91200c295a46b7282ee05d9438ceb5be5f12ed177a5de68`

Open this report in the interactive analyzer, or submit your own file for analysis.