PDF malware analysis — malicious · 6dd56bb9d3455483

MALICIOUS

PDF

82.1 KB Created: 2021-05-23 21:22:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25

MD5: 9d59c89b4c738c1fccfd70d7a2a68b68 SHA-1: d30e98ebcdedc57611cecde1e4bb86f0e5b221b2 SHA-256: 6dd56bb9d3455483b2ffc11c4deaf77cd3e88b8a1fd2b22b8ad9b4165fdf66fe

194 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it's a malicious redirector, specifically designed to lure users to a phishing or malware distribution site. The embedded URL `https://yafferge.ru/strik?utm_term=speed+queen+front+load+washer+error+code+ed29` is flagged as malicious and part of an SEO phishing lure. Although no scripts were explicitly extracted, the nature of the redirector and the ML classifier's high confidence score suggest a malicious intent to deliver a payload or phish credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/strik?utm_term=speed+queen+front+load+washer+error+code+ed29 In PDF document text
- https://cdn-cms.f-static.net/uploads/4499341/normal_6068af3b2e25e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426945/normal_600b4fa12dfa8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421944/normal_5fec488d16fe3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489441/normal_60285b9db55cb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414174/normal_603eb27071cc2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416660/normal_600c233494dae.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470982/normal_60324c33ab131.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414167/normal_604a5af70d57d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454803/normal_5fc9cc171c79e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369777/normal_5ff874bb827ee.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/5024bce4-f1c6-4a82-843f-43bba556b35d/95261646457.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45212aca-e4b8-4c81-83cf-805d3d393d9a/what_age_can_you_get_your_license_in_ma.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/efb4920f-4e6b-4a5e-9e54-3dca6e05ead1/brandon_bernard_execution_last_meal.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/49471884-021f-4889-8db5-0f2ad41500a3/50_tons_mais_escuros_livro_resumo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ae5ab0ed-3c75-4e7e-8660-0a4d0a8e67f5/meade_lx200_classic_hand_controller.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6b62c165-a749-47ba-be20-5fd6f4f3e678/49087526048.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fdd27563-063d-45fb-8d0c-35bc5bb2a8d3/40712510771.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ead2fb3-0e1f-40dc-bf6a-36ed2020a665/10321262407.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32bad565-add4-4daa-a8a7-b3488c2a53f1/xuxan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d5f572bb-4d5d-446a-ae9c-a0762c46cd46/kirulujuwotininivawolo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b786d124-5184-48e0-acde-fd92bf52cf46/bunapisozivovafoxez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d438577-c4ae-4a8a-ae50-b559b0433567/sample_intercessory_prayer_examples.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5316bf59-36ac-41c9-b0db-7b39422d8b1f/surely_youre_joking_mr_feynman_sparknotes.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f5bd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5BD	5684 bytes
SHA-256: `115b9ea134b3be5d068bd154a9e06f514d924fb357c18ad7e834faf08a812127`
`font_01_sfnt_off0001091b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1091B	10320 bytes
SHA-256: `940687b1e46d8c3335ce1b4306dffe33c31a0a18c571ecd68828d6f9a0e70a5e`
`font_02_sfnt_off00012c66.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12C66	4324 bytes
SHA-256: `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`

Open this report in the interactive analyzer, or submit your own file for analysis.