Malicious PDF — malware analysis report

Static analysis result for SHA-256 04a9a821638bde5e…

MALICIOUS

PDF

60.9 KB Created: 2021-02-15 04:44:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 1475bfbdce29fdb73c70e59c1cb7886e SHA-1: c7310f909206fa3be2704e6c398228114888ba47 SHA-256: 04a9a821638bde5e7925c742f615f2a43edf11b8329f5e74f69127dd77089789
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/wb?keyword=chadta%20suraj%20dheere%20dheere%20dj'. Additionally, a high-severity heuristic indicates a browser extension/update installation lure, a common social-engineering tactic. The ML classifier also flagged this PDF with high confidence, and ClamAV detected it as 'Pdf.Phishing.Trojan'. These indicators suggest the document is designed to deceive users into downloading and installing malicious software or providing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/wb?keyword=chadta%20suraj%20dheere%20dheere%20dj In PDF document text
    • https://cdn.sqhk.co/kobewudojuvo/jehfhas/ludo_pro_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/fowijuseziju/eiijiKP/big_phone_for_seniors_full_version_apk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417138/normal_5fdac9c9c5d17.pdfIn PDF document text
    • https://cdn.sqhk.co/tavanaru/rHgej2w/tidesisasupe.pdfIn PDF document text
    • https://cdn.sqhk.co/dimowitop/xficjih/ninitadupon.pdfIn PDF document text
    • https://cdn.sqhk.co/kuwusetoteji/hgjpoud/portal_3d_model_thingiverse.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500669/normal_5fe2e9de6f7ac.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/desenaz/trastornos_alimenticios_en_adolescentes.pdfIn PDF document text
    • https://s3.amazonaws.com/mufukep/93959521922.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/basalte_deseo_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/mupukesunobaga/alpinestars_andes_drystar_pants_size_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/zaxawetawupo/keralemenepivaselosi.pdfIn PDF document text
    • https://s3.amazonaws.com/wifiduxezo/pdf_to_word_converter_arabic_support_online.pdfIn PDF document text
    • https://s3.amazonaws.com/mujesogi/video_angling_dharma_episode_34.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b22f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB22F 4860 bytes
SHA-256: 3bea88fb79fc4ffa94ad8f309c776383ab597dc164c47d82a5af24f36e3009a0
font_01_sfnt_off0000c2a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2A7 10644 bytes
SHA-256: ccd2ef86e66a5823b0e70059c26fa709bfbe22d1e061cfad70e1d316c01e0bcd

Open this report in the interactive analyzer, or submit your own file for analysis.