PDF malware analysis — malicious · 02aba88fd4bb0ffd

MALICIOUS

PDF

71.5 KB Created: 2021-04-01 21:09:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: 27d13d3026d134f81f0efe18ed9fe5c4 SHA-1: 844edd6f43abe692334618f3281ce5d103868e0d SHA-256: 02aba88fd4bb0ffd627539fd9b3d213116a12df29dba59e290b9d0ca74ffd021

214 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, identified as a link farm, designed to redirect users to malicious websites. The primary malicious URL observed is 'https://yafferge.ru/strik?utm_term=creating+equivalent+ratios+worksheet+answers', which is flagged as a known malicious redirector. The document's structure and the high ML classifier score indicate a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/strik?utm_term=creating+equivalent+ratios+worksheet+answers In PDF document text
- http://sutiwejepeb.22web.org/78758394199.pdfIn PDF document text
- http://zurafumodajirof.iblogger.org/jurapigaze.pdfIn PDF document text
- http://mufawajidoxe.22web.org/52790682543.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://7c9e9c40-2b96-4f88-8065-b5ff5e495659.filesusr.com/ugd/3bfcae_fbff3e4a2f8c447ebed270ff3ba6b068.pdf?index=trueIn PDF document text
- https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_47eb0d76d7ee4d1c9043892ab73d2f52.pdf?index=trueIn PDF document text
- https://217ba8a6-026c-4a9e-b1ce-2eadff0a4a08.filesusr.com/ugd/3d7af5_49fbb1768a0245f2bb76dcdf7ad2c463.pdf?index=trueIn PDF document text
- http://rufazigivemebod.rf.gd/opportunities_challenges_and_power_of_media_and_information_in_economy.pdfIn PDF document text
- http://rawotagetanona.rf.gd/love_story_sheet_music_piano_free.pdfIn PDF document text
- https://s3.amazonaws.com/lefemijip/adobe_after_effects_2015._3_full_version.pdfIn PDF document text
- https://s3.amazonaws.com/tiduro/kupibefuraxamajiwa.pdfIn PDF document text
- https://22e365c6-0853-42e1-82f8-83473bf9c0bf.filesusr.com/ugd/217d68_b199fd30cb3146ff961c3c79bdb6ce93.pdf?index=trueIn PDF document text
- https://3350d16e-2476-487b-844f-3942c02081ad.filesusr.com/ugd/25270e_16998a6336ce4f4c8613c8309d16293d.pdf?index=trueIn PDF document text
- http://ramawotinejog.epizy.com/35409955959.pdfIn PDF document text
- https://s3.amazonaws.com/safenalavojuwu/43903207922.pdfIn PDF document text
- https://s3.amazonaws.com/rizijubovapuk/casetify_cases_android.pdfIn PDF document text
- http://nozimazanu.epizy.com/formative_assessment_methods.pdfIn PDF document text
- https://s3.amazonaws.com/devuxuzejozam/america_2020_free_download_fonts.pdfIn PDF document text
- https://5053e88e-9e18-4719-890c-32a1cca0295d.filesusr.com/ugd/411503_afbdd351cef64da289605ef15cdfbbc2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jopomodilamego/geography_quiz_questions_and_answers_printable.pdfIn PDF document text
- https://s3.amazonaws.com/ponivotigegepub/clumsy_ninja_new_version.pdfIn PDF document text
- http://votitagupen.epizy.com/magnetic_field_worksheet.pdfIn PDF document text
- https://s3.amazonaws.com/wujodibu/luvejiboxozapovonasar.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cee9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCEE9	5192 bytes
SHA-256: `76d951e6a83cebff1eb577a16ecc927b77b2aab4d230b9304db14b99c5ed036f`
`font_01_sfnt_off0000e0a0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE0A0	9784 bytes
SHA-256: `cd7106ce56458430943a9faeb745dfad18f1d04879406a5fa004f111ea6dbf84`
`font_02_sfnt_off00010211.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10211	4324 bytes
SHA-256: `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`

Open this report in the interactive analyzer, or submit your own file for analysis.