Malicious PDF — malware analysis report

Static analysis result for SHA-256 541bababebabd845…

MALICIOUS

PDF

68.9 KB Created: 2021-03-12 07:01:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95882bb249dec6229cea93e3016a0c21 SHA-1: 75008b728b3db7f5ccdbefe314a080151eea93ca SHA-256: 541bababebabd84526c7ab14d7506b6eaf021c84dff3f0f49b5d35afd91f232a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a malicious redirector link to 'yafferge.ru', identified by critical heuristics and ClamAV. This indicates the document is designed to lure users to a potentially malicious website, likely for phishing or malware delivery. While no scripts were explicitly extracted, the presence of embedded URLs and the ML classifier's high confidence suggest a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=can+vizio+tv+connect+to+bluetooth+headphones
    • http://tiktoktop.design/2354876887wmpp2.pdf
    • http://toluvubub.mygamesonline.org/tibetan_buddhist_meditation_techniques.pdf
    • http://talakam.space/557859372107qh9b.pdf
    • http://marafonsport.site/683929702v0015.pdf
    • http://tajuliwelofiti.medianewsonline.com/59841243490.pdf
    • http://uptodate.site/67113044971hk44q.pdf
    • http://ch-data-2a8fv9s.pw/55021255957e494e.pdf
    • http://ital-tess.space/what_does_ou_mean_for_eyes50f2b.pdf
    • http://teaitalis.space/udbeningsmaskine_til_kyllingebryst6l2t0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gagagakigibapo/wyoming_guided_elk_hunts.pdf
    • http://furunes.onlinewebshop.net/periodicity_of_periodic_table.pdf
    • http://belunovozexuse.rf.gd/80346879261.pdf
    • http://fugewep.rf.gd/german_alphabet_pronunciation_guide.pdf
    • https://s3.amazonaws.com/bolovopizonuki/abhijit_banerjee_book_poor_economics.pdf
    • https://s3.amazonaws.com/fowikorejodi/86743347576.pdf
    • http://pedamodaw.onlinewebshop.net/guitar_fingerboard_notes.pdf
    • http://xogowakowokavuw.rf.gd/advanced_english_learning_books.pdf
    • https://s3.amazonaws.com/dudujopixejikug/pozixukerinobajajexazo.pdf
    • http://jiwimid.epizy.com/hobbies_worksheet_printable.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cfa7.bin
eee1f3078d28766b005efa20becabf2a592083284e59742faf15698d750e33d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCFA7 5220 bytes
font_01_sfnt_off0000e167.bin
1ae3e9d6a21e4d4b9c9fce964f7597b5ffc6b52d117decb16dd6bb6574e00a61		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE167 10864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.