Malicious PDF — malware analysis report

Static analysis result for SHA-256 275000c1d17db1b5…

MALICIOUS

PDF

80.7 KB Created: 2021-05-03 09:01:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 78721c2c07f5562215275d19fc9db253 SHA-1: 0ddae1cc0b7a710c3ce3fff6c101fa1b902b12c4 SHA-256: 275000c1d17db1b57647d395625e7cd14b83c6e5ab614e3e6df7eeef016bb4a8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://dafemum.ru/strik?utm_term=maya+angelou+barbie+doll+uk'. ML classification and ClamAV also flagged this file as malicious. The document body is heavily obfuscated, but the presence of embedded URLs and the redirector link strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=maya+angelou+barbie+doll+uk In PDF document text
    • https://cdn.sqhk.co/popenewosaso/jjhbha4/davis_pro_cleaning_services_llc.pdfIn PDF document text
    • https://cdn.sqhk.co/wepiwuvume/iijeRRT/cookie_macaron_pop_sweet_match_3_puzzle.pdfIn PDF document text
    • https://cdn.sqhk.co/gosukutusu/ichdnif/vajuzapodilumimowavimipeb.pdfIn PDF document text
    • https://cdn.sqhk.co/nodewanase/CRhjl0e/53286509998.pdfIn PDF document text
    • https://cdn.sqhk.co/kotolodegag/hh7Xtgh/kugumaruvinubizofeligo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5ccb110-f5c9-4e26-9529-6438cb917881/descargar_la_biblia_reina_valera_1960_para_pc_windows_7.pdfIn PDF document text
    • https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_bfed7f4527304bdaa762b2654cfa9dc4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f75aada-ed51-4685-82e7-7592eb2bc706/wotowumurijeragoke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fd0f5c4-0b38-4179-a9ab-a027c3b4e23b/fuzizusen.pdfIn PDF document text
    • https://fe92b815-f0fe-4223-924b-659339f44b90.filesusr.com/ugd/8f64fc_2855ddb9303a43e080c2c2dfe2eed72d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8ccf566-8ac5-4a47-bd17-4d3ad32efbe3/what_bread_can_you_eat_on_fodmap_diet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64f0e15e-09bf-4ce9-a878-a6220cbb7e55/11735986870.pdfIn PDF document text
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_33bcdba098364a9f8d5ac721a7e97a52.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/benuka/63526260947.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92ed557e-7324-417c-a941-3b7886123a41/number_flashcards_1-20.pdfIn PDF document text
    • https://s3.amazonaws.com/fovezewi/91736333482.pdfIn PDF document text
    • https://835a0401-7144-467e-aacc-710587930ffc.filesusr.com/ugd/432cba_cbdbf2772818478d93b8799adc6e7906.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fdfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDFA 5128 bytes
SHA-256: f9bfdfbff2727d2c49864f79a10a400ce60494e1659c1a5296549fa9460bbe81
font_01_sfnt_off00010f8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F8E 11220 bytes
SHA-256: 20c8bce41f0d5d3e88589ef85f67e1e6f1cbae20ed612712aaf9f64cf3629d6e

Open this report in the interactive analyzer, or submit your own file for analysis.