Malicious PDF — malware analysis report

Static analysis result for SHA-256 6fd1c880123ec2ea…

MALICIOUS

PDF

81.1 KB Created: 2021-04-08 20:47:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 142f0facc504a8ec9744911e31efb20a SHA-1: a7ed6f64b3543576d05edb409392498a3994804c SHA-256: 6fd1c880123ec2eac35a0c3d9faafcb4188ff2397c171449f7c23195ce75d552
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by multiple heuristics, including a critical finding for malicious redirector links and a high ML score. The embedded URL 'https://dafemum.ru/strik?utm_term=alkaline+diet+foods+recipes' is identified as a malicious redirector, indicating an attempt to lead the user to a harmful site. The document body, though heavily obfuscated, contains text related to the lure. The overall pattern suggests a phishing or malware distribution attempt via a malicious PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=alkaline+diet+foods+recipes In PDF document text
    • http://hookup153.online/bksb_maths_fs_initial_assessment_answerssz2g6.pdfIn PDF document text
    • http://power-guard.shop/96376738610ehcfr.pdfIn PDF document text
    • https://cdn.sqhk.co/zinoliwomi/ijbhhii/51920753413.pdfIn PDF document text
    • http://kijekidajefi.getenjoyment.net/hidden_african_history.pdfIn PDF document text
    • http://golosa-spasibo.ru/how_to_get_bing_maps_on_androido3fds.pdfIn PDF document text
    • http://jusapp.club/is_list_making_a_sign_of_ocd15onc.pdfIn PDF document text
    • http://mevukavotidu.getenjoyment.net/absurd_theatre.pdfIn PDF document text
    • http://kojijeku.mygamesonline.org/23859473507.pdfIn PDF document text
    • http://zyzycheat8.xyz/cambiar_tipo_de_grafico_en_excel_201003zsr.pdfIn PDF document text
    • https://cdn.sqhk.co/xukerejolar/GVjBhhe/10918820067.pdfIn PDF document text
    • https://cdn.sqhk.co/noxivudeva/hfvyhgd/51410354112.pdfIn PDF document text
    • http://rexonina.medianewsonline.com/goal_setting_worksheet_for_students.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jolunenafobuw/32112502763.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13236e12-701f-4d39-8c8c-2db9ffff3ace/how_to_use_the_e_button_on_ti-30xa.pdfIn PDF document text
    • https://s3.amazonaws.com/tosego/should_i_learn_to_code_in_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/lomiwexuva/verewusegovu.pdfIn PDF document text
    • https://s3.amazonaws.com/mutirexa/plant_cell_parts_and_their_functions.pdfIn PDF document text
    • http://vexolofifete.atwebpages.com/romuzoto.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/324fa9be-a435-41c0-9c69-9994b8014c66/jeletakufofovurilunana.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7786ba1b-f9e4-4e9e-8540-91d5a3c1259a/bolakezajabis.pdfIn PDF document text
    • https://s3.amazonaws.com/fapaga/kolkata_puja_guide_app.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/833dc91d-8c58-40da-b71b-ec48e99f5273/house_of_spirits_full_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/vigevot/bhairava_dweepam_songs_ing_telugu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1BB 4988 bytes
SHA-256: ebb60d4e3ba10376fbc73abfd6d1629dd7e2b779d8616daf65c52122e4dc0ffe
font_01_sfnt_off000102b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102B7 11084 bytes
SHA-256: 45b1e3758538ce0ac5e95df822033ed05d81b036748b39f70d3a34220379f029
font_02_sfnt_off0001284f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1284F 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.