PDF malware analysis — malicious · 7410b1335bfbcc8e

MALICIOUS

PDF

79.9 KB Created: 2021-02-21 05:31:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04

MD5: 3f39c3a958d57cdc3cdbd749d3c0883e SHA-1: e31c2fd877254d11446519f735f7fb25068baaa9 SHA-256: 7410b1335bfbcc8e1a1356c1c22d0193de48e8c51ef44b8d5a884bd8167f7d45

222 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/wix?keyword=dhgate+payment+verification+reddit', suggesting a phishing or malware delivery attempt. Another critical heuristic indicates a PDF link farm, with one of the first URLs being 'https://cdn.sqhk.co/kasuvapexal/dIhbWUW/jedupujopinupugizu.pdf'. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of these malicious links and the overall structure indicate a likely attempt to exploit the user's trust for malicious purposes.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/wix?keyword=dhgate+payment+verification+reddit In PDF document text
- https://cdn.sqhk.co/kasuvapexal/dIhbWUW/jedupujopinupugizu.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486758/normal_5fcc7219e6465.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368747/normal_602221c53c4f4.pdfIn PDF document text
- https://cdn.sqhk.co/dedogupazib/0jgEmbu/62358670481.pdfIn PDF document text
- https://nesamakamaxo.weebly.com/uploads/1/3/1/6/131636712/009c75dba.pdfIn PDF document text
- https://cdn.sqhk.co/gegenosuzun/76ihRnK/40081819854.pdfIn PDF document text
- https://cdn.sqhk.co/nedivixozu/hrMlxgg/mimpi_hamil_anak_kembar_artinya_apa.pdfIn PDF document text
- https://wobubowez.weebly.com/uploads/1/3/4/7/134709338/mewukamax_todidesepi_luwewiwozumo.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4405654/normal_5fe495420302b.pdfIn PDF document text
- https://menolalosixoj.weebly.com/uploads/1/3/4/7/134714047/120909.pdfIn PDF document text
- https://cdn.sqhk.co/sivadapexiri/hbW1ihT/14428285573.pdfIn PDF document text
- https://cdn.sqhk.co/vopupevomate/jgfifgj/chemical_elements_listed_by_ionization_energy.pdfIn PDF document text
- https://cdn.sqhk.co/numiwuzuwix/b43hdia/feneduverisinowumonibege.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420764/normal_600d6191cce05.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/wazotojemov/agent_ransack_cnet.pdfIn PDF document text
- https://s3.amazonaws.com/limewub/nibasowor.pdfIn PDF document text
- https://s3.amazonaws.com/fajetufekejo/33283457104.pdfIn PDF document text
- https://s3.amazonaws.com/fedufiporara/star_trek_next_generation_series_5_episode_19.pdfIn PDF document text
- https://s3.amazonaws.com/gizonukorad/apa_citation_generator_apa_format_guide.pdfIn PDF document text
- https://s3.amazonaws.com/xoferuzu/16757124736.pdfIn PDF document text
- https://s3.amazonaws.com/nilititonawafim/bheema_telugu_songs_ringtones_free.pdfIn PDF document text
- https://s3.amazonaws.com/tobojelusiwi/bewanemibotakekifiwom.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fb4f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB4F	5520 bytes
SHA-256: `1ca07a0bfa16c4492333b29e32d960f35f7bf047874a4b6828d003c71dfff151`
`font_01_sfnt_off00010e02.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E02	10564 bytes
SHA-256: `bd16b2a14eb6d1039f269811eb72e147e7ce99b22c429b668572c2bf77b26310`

Open this report in the interactive analyzer, or submit your own file for analysis.