Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c376a6203a55e6e…

MALICIOUS

PDF

44.9 KB Created: 2021-03-11 22:25:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cf2939c30c91f8036f70aef88135880 SHA-1: 4c3b040cb35d7df84360fc08223216dd8ea62d61 SHA-256: 4c376a6203a55e6e17127b31b17eb534aefcce038838ae31803ffcf32ed5d25d
202 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by multiple heuristics and ClamAV, indicating it functions as a phishing lure. It contains a screenshot designed to trick users into clicking a link, which redirects to a known malicious infrastructure at 'https://yafferge.ru/award?keyword=ruled+paper+printable+pdf'. The document body is heavily obfuscated and appears to be image-based, consistent with a lure tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6920

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 44 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=ruled+paper+printable+pdf
    • https://cdn-cms.f-static.net/uploads/4491157/normal_601ffd558a225.pdf
    • https://cdn-cms.f-static.net/uploads/4450356/normal_6021b9d8c3cff.pdf
    • http://pukebebizadolu.mypressonline.com/list_of_wh_family_words.pdf
    • https://static.s123-cdn-static.com/uploads/4483354/normal_5feccb936e605.pdf
    • https://cdn-cms.f-static.net/uploads/4391624/normal_6033ef208c26b.pdf
    • http://midikakuvekume.mywebcommunity.org/xaforejuriv.pdf
    • https://cdn.sqhk.co/wujamufaw/jbFDWih/5579214558.pdf
    • https://static.s123-cdn-static.com/uploads/4488804/normal_600667f947cc1.pdf
    • https://cdn.sqhk.co/mugodetutag/ghm2xhq/smash_hit_game_modes.pdf
    • https://cdn-cms.f-static.net/uploads/4460042/normal_603d49db4f690.pdf
    • https://cdn.sqhk.co/kulobuwaxegu/ag4xFwG/black_screen_youtube.pdf
    • https://cdn.sqhk.co/vozaxodep/lj9gjij/transgender_surgery_procedure_codes.pdf
    • https://cdn-cms.f-static.net/uploads/4464878/normal_5fd2a2c7983d0.pdf
    • https://static.s123-cdn-static.com/uploads/4391899/normal_5fe26a17d1957.pdf
    • https://static.s123-cdn-static.com/uploads/4366973/normal_5ffe6619d9352.pdf
    • https://cdn.sqhk.co/zenetofuma/SX7JBXk/animal_crossing_paths_qr_codes_brick.pdf
    • http://wepisoja.mypressonline.com/canard_pc_hardware_13.pdf
    • https://c245485c-e1a4-4c5a-9a2a-c465a95e53c8.filesusr.com/ugd/25f824_d2d4b138863f4f70ac965d7cc586e9f7.pdf?index=true
    • http://molagegivijoxu.onlinewebshop.net/sharepoint_online_training_courses_free.pdf
    • https://b4140449-9b96-4148-8619-c9b3eed7b48c.filesusr.com/ugd/c33cdb_921fce3657a54b0eaa7d7e4816b89d21.pdf?index=true
    • https://6eed613e-cbae-405e-b458-9655ef9033f8.filesusr.com/ugd/e4f6f0_05a1797f7f7b453b83d53fe6b6b0d575.pdf?index=true
    • https://s3.amazonaws.com/bezutu/fire_guard_test_questions_and_answers.pdf
    • https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_0b102e400da9410c91f0d0285091fa82.pdf?index=true
    • https://ba30dffa-51fe-4caa-9472-6f142403a9bb.filesusr.com/ugd/c2007e_3da53ff8d15e4522b14ef81cad077b22.pdf?index=true
    • https://s3.amazonaws.com/fadedosi/bandori_cover_songs.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.