PDF malware analysis — malicious · 75e01e0ad8ac8bc9

MALICIOUS

PDF

77.9 KB Created: 2021-03-05 23:49:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22

MD5: 5c4ccc04da2615c85665ea2c17ea4965 SHA-1: e5941289c7e6ceeb99d5016367f87551456357a8 SHA-256: 75e01e0ad8ac8bc94b2ccb771e7ce96c92fa98f35a3ffdf5de24619caf5ed1b9

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/strik'. This URL is likely intended to lead the user to a malicious site, possibly for phishing or malware distribution. The document body, though heavily obfuscated, contains text related to search queries, suggesting a lure. No scripts were extracted, but the presence of a malicious URL is a strong indicator of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/strik?utm_term=how+big+of+a+turkey+will+a+22+quart+roaster+hold In PDF document text
- https://cdn-cms.f-static.net/uploads/4427509/normal_5fd83777319e7.pdfIn PDF document text
- https://cdn.sqhk.co/xeloxilava/D6niiun/lakopop.pdfIn PDF document text
- https://cdn.sqhk.co/gokovolasula/tieCggr/a3_otome_anime_game_mod_apk_unlimited_money.pdfIn PDF document text
- http://solimabifiper.iblogger.org/what_fast_foods_have_gluten_free.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481663/normal_600d71121e418.pdfIn PDF document text
- https://cdn.sqhk.co/zidomirit/8gjLhiN/lesozipajikuvunonixolexam.pdfIn PDF document text
- http://fudasoba.iblogger.org/happy_holidays_gift_tags_template.pdfIn PDF document text
- https://cdn.sqhk.co/jugemito/geidH29/anime_high_school_simulator_apk_download.pdfIn PDF document text
- http://jurabosuw.22web.org/38232125179.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/bopuxosavubare/13415091497.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/09dd0c76-ad9a-4124-9403-5ad0fe3cb33f/18565611501.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2e4debba-0932-47a9-96da-a2f82cad5e42/how_to_change_my_homepage_on_microsoft_edge.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1862ec22-7fee-4c46-8f44-680dc8b7d845/popofirelamirugosit.pdfIn PDF document text
- https://s3.amazonaws.com/tisegovofu/77751679420.pdfIn PDF document text
- https://s3.amazonaws.com/kikunojulejuj/stuart_wilde_miracles.pdfIn PDF document text
- http://boterafozove.rf.gd/bahut_aayi_gayi_yaadein_song_lyrics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/611ae6cf-4f89-4a42-96d2-bac09ef997f9/delta_q_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a1b87649-ea4f-46b8-8885-55f351ccfdf0/61435442932.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d8252471-2c48-4c6c-aefc-69e8d425b8d0/54889766171.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c65008ff-daae-41a6-a3a7-59ace7387077/79720404502.pdfIn PDF document text
- https://s3.amazonaws.com/piwanisaj/brevet_du_collge_report.pdfIn PDF document text
- https://s3.amazonaws.com/golepe/engine_blueprinting_sheet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e014.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE014	5564 bytes
SHA-256: `29e5c38a59d0aca47a1171e628a7d4c3c95e45aa8aa8ff12e2a80b9693122716`
`font_01_sfnt_off0000f327.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF327	11608 bytes
SHA-256: `fb5fdfa3ad1de1ba5bdd017124683eb1b8c2d4f3fa315d104e1c8ab545f7c28f`
`font_02_sfnt_off000119e9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x119E9	4324 bytes
SHA-256: `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`

Open this report in the interactive analyzer, or submit your own file for analysis.