Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b3feb9111a285df…

MALICIOUS

PDF

81.3 KB Created: 2021-03-15 23:33:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c256558c0ff0ba036039dceaa3076bc6 SHA-1: 227ec136a2050522a54613a37b2c73ece3cb8ab7 SHA-256: 6b3feb9111a285dff800f5e15cf0205e426edd6e077a7e566a6a155fbe0d3479
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged as malicious by multiple heuristics, including a critical alert for a malicious redirector link. The embedded URL points to 'https://yafferge.ru/strik?utm_term=what+are+the+roles+and+responsibilities+of+software+architect', which is a strong indicator of a phishing or malware distribution attempt. The ML classifier also provided a very high score, further supporting the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=what+are+the+roles+and+responsibilities+of+software+architect In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369146/normal_5fd9389eb04a0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444644/normal_600e89cd0feb1.pdfIn PDF document text
    • https://cdn.sqhk.co/vudupapuj/UghvgiX/2nd_grade_math_worksheets_addition_and_subtraction.pdfIn PDF document text
    • https://cdn.sqhk.co/bedazume/crxhiib/tuvuxagebanujaxavi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479674/normal_6005a85b0a30f.pdfIn PDF document text
    • http://tixshopclub.fun/what_cherokee_nation_district_am_i_in9xaid.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461525/normal_601e65335f2d3.pdfIn PDF document text
    • https://cdn.sqhk.co/zasokolof/4Ucibha/bubble_witch_saga_3_hack_apk_download.pdfIn PDF document text
    • http://4escam-bot.online/fawupe0ii30.pdfIn PDF document text
    • https://cdn.sqhk.co/xinefegepe/gdmhdOn/26809921105.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376375/normal_603a8befd6609.pdfIn PDF document text
    • https://cdn.sqhk.co/tidelefuzin/ijgjgj7/bitbucket_tutorial_for_beginners.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457330/normal_5ffb2a1b41e65.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474978/normal_6007ef57c8ba1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tinezedu/ksrtc_bus_simulator_game_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/pazerogasarinu/birulofasovebejiwig.pdfIn PDF document text
    • https://s3.amazonaws.com/jevelel/sofobo.pdfIn PDF document text
    • https://s3.amazonaws.com/mafavuzenoliki/australian_companion_planting_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/zoxewudunigus/angry_birds_online_free_no.pdfIn PDF document text
    • https://s3.amazonaws.com/gifiz/it_comes_at_night_imdb_parents_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/kotenu/learn_more_python_3_the_hard_way.pdfIn PDF document text
    • https://s3.amazonaws.com/xefejevife/xopotibubefuletivuw.pdfIn PDF document text
    • https://s3.amazonaws.com/muvemasoxaji/35175924511.pdfIn PDF document text
    • https://s3.amazonaws.com/fonibinaraj/human_body_worksheets_for_elementary_students.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001008f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1008F 5488 bytes
SHA-256: 32bfd58efe7c42eaa38ee94cbfe006dce63b4a97a51ab820e7b87a98b0ac66ad
font_01_sfnt_off00011346.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11346 10488 bytes
SHA-256: 17c88778bc82bcab6b6418feabea1616fdfd38d9e8d7967a2009496c97e1a43e

Open this report in the interactive analyzer, or submit your own file for analysis.