Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d6304c98ec77b78…

MALICIOUS

PDF

318.5 KB Created: 2021-05-17 12:56:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: a0a5602ccc7e362259d493f73fbf7a77 SHA-1: 80bd8ef30eff21cdcd81a898c0a59e3cf6f392c2 SHA-256: 2d6304c98ec77b78004c8d4ccab3b19664bc6707dbc05540e9ba2bbe98ec0c3b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/strik?utm_term=historia+de+espa%25C3%25B1a+siglo+xix+6+primaria'. This indicates the document's primary purpose is to lure the user to this malicious site. The ML classifier also strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9926

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=historia+de+espa%25C3%25B1a+siglo+xix+6+primaria In PDF document text
    • https://cdn-cms.f-static.net/uploads/4444110/normal_6017386db6ab4.pdfIn PDF document text
    • http://fresh-ita.fun/watch_pixel_online_free_megavideomwfbw.pdfIn PDF document text
    • https://cdn.sqhk.co/zexukobesu/UhaheSS/carnival_cruise_cancellation_policy_due_to_illness.pdfIn PDF document text
    • https://cdn.sqhk.co/zijigemeworu/Shihdp3/car_running_board_repair_cost.pdfIn PDF document text
    • https://cdn.sqhk.co/bepeguvovori/icjjgI5/43921462864.pdfIn PDF document text
    • https://cdn.sqhk.co/kepolapawef/imKaZSw/xepatukowimu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488330/normal_605a7d3b36b6c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413978/normal_6019c8e98adee.pdfIn PDF document text
    • http://zapemik.iblogger.org/applied_mathematics_1_syllabus_for_diploma.pdfIn PDF document text
    • http://begetus11ppz.xyz/subaxofemilenomlasv.pdfIn PDF document text
    • http://glawerry.online/a_christmas_carol_full_story_by_charles_dickensojjih.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://zowonotetejubi.rf.gd/zaveru.pdfIn PDF document text
    • https://s3.amazonaws.com/towutoginadivu/toto_toilet_installation_instructions.pdfIn PDF document text
    • http://bojuzafi.rf.gd/fotenajukajudisugobaf.pdfIn PDF document text
    • http://warufadul.rf.gd/ablative_absolute_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/veraxawewib/football_maths_worksheets_ks1.pdfIn PDF document text
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_3feb90ad01f2413fb7b0a1c4b72d371f.pdf?index=trueIn PDF document text
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_62a8a0551ea24b05911bf7f5619228ba.pdf?index=trueIn PDF document text
    • https://80c93ba6-74df-4afb-9852-3a83eaba20e3.filesusr.com/ugd/4cf28d_acd0d46a05c8418bb4be428ae0bb6f8d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juduk/lasisijavinomenulas.pdfIn PDF document text
    • http://vevurikadi.epizy.com/tenamexumijegojasiliw.pdfIn PDF document text
    • https://s3.amazonaws.com/telasebisu/dirt_bike_parts_and_accessories_near_me.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00049d0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x49D0A 5356 bytes
SHA-256: a4fbbcda319dc27e9fcfe8dfb7365d3b0c5de1e695aebed61dd21f5d9903ae18
font_01_sfnt_off0004af1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AF1E 13896 bytes
SHA-256: e8cb7c8d8526ad6a8e6d831e2baecb1b472789a6614b44187efa3ddf6ce3de84
font_02_sfnt_off0004da94.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4DA94 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.