Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a77ab59e1de9d2c…

MALICIOUS

PDF

127.5 KB Created: 2021-04-17 02:15:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 21f89a7f0aa6496be28fcd3e669cd926 SHA-1: c467ca926b54897b8654c60e48a15561ab2eb7b1 SHA-256: 0a77ab59e1de9d2cee5791e2dc7a5868b2d11be25077d92ef38cda1c4f7ed6b5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/strik'. This URL is likely used to lure users to a malicious site. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of a malicious URL within the document's structure indicates a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=you+hear+those+sleigh+bells+ringing+lyrics In PDF document text
    • https://cdn-cms.f-static.net/uploads/4375694/normal_5fd68628cf19d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476432/normal_60170f46de239.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450730/normal_60349de550392.pdfIn PDF document text
    • http://8bitbeardsco.com/detemibbiwg.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391302/normal_6016cfe3a3147.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454546/normal_603f92358d89b.pdfIn PDF document text
    • http://tells.fun/bach_marcello_piano_sheet_musicl86e4.pdfIn PDF document text
    • http://de-bewertung-889562.icu/japedozoxijazaxuwozizuhjkjh.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494433/normal_5fd963144502c.pdfIn PDF document text
    • http://useplafond.xyz/mexalux8s3g6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375075/normal_600d9b20c5724.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480598/normal_606b4cd7d8542.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/acb8104c-a785-4a77-a6c7-c3ea3b2e2fe4/a_practical_english_grammar_exercises_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1fee967-93e4-4c34-9f66-b5cbb222a1bc/what_is_the_basic_storyline_of_les_miserables.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fa7b48a-f435-4353-9cbe-19b24251d157/zipenovavujiviled.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c44df8aa-9113-4ab9-8a52-4900375b0c47/day_9_21_days_of_abundance_meditation_deepak_chopra.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fa302c4-ad6e-4c9d-be2c-891877ca7e5f/dotisebefamo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc5af391-8c24-4e0f-bdc4-2e9b5952c9b5/how_to_use_lg_aircon_without_remote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aec850ae-ffce-407b-86e9-01288f9d7e99/zosenoritejuxutafi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3deaa79f-7bb4-4400-8a07-faccb8e7b5d4/80841020856.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019356.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19356 5148 bytes
SHA-256: 8f495d4d27b1af6a9ff701130976f954999b7947a73d37e779c53736afd61bcd
font_01_sfnt_off0001a4dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A4DD 11768 bytes
SHA-256: 34c9616aea6b32cdd89236c1f7b783e710fe39c22fda78b91af12383c358052c
font_02_sfnt_off0001cce2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CCE2 16092 bytes
SHA-256: 9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2
font_03_sfnt_off0001e1a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E1A9 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.