Malicious PDF — malware analysis report

Static analysis result for SHA-256 761e71c90375224c…

MALICIOUS

PDF

79.3 KB Created: 2021-05-10 08:46:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: b45a6a4d07f366558a5e927d16c22953 SHA-1: 2ba474593ddcf20c02d419edb97310edfd945afd SHA-256: 761e71c90375224c8514044f4961b0623ecf3b982b68db5972d142b611cec069
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, and contains numerous embedded links. One critical heuristic identified it as a PDF redirector link pointing to a known malicious domain (yafferge.ru), and another identified it as a PDF link farm. The document body, though heavily obfuscated, contains text related to book orders, likely a lure. The presence of many external links suggests an attempt to direct users to potentially harmful content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=what+order+are+the+robert+langdon+books In PDF document text
    • https://xelasukozulete.weebly.com/uploads/1/3/2/6/132681542/235ad1f5fda07f.pdfIn PDF document text
    • http://vuzitofakomuj.22web.org/capture_one_version_10.pdfIn PDF document text
    • https://zunejafeg.weebly.com/uploads/1/3/4/3/134382709/e3ad3a505fc6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rifobotulaw.rf.gd/jurobigovezatap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a907ab87-8a16-4c0c-a1d4-3f8701e4c951/69085775883.pdfIn PDF document text
    • https://b615eccc-4413-4b1d-8109-ede925130a83.filesusr.com/ugd/0994f9_5da3df0052854ecea9e3e8d6fb3b8a49.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/eee2ddd7-ff3e-47de-8f2f-cda333a871d8/garmin_920xt_band_width.pdfIn PDF document text
    • https://s3.amazonaws.com/nuruvapozixix/23282000163.pdfIn PDF document text
    • https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_998ac72344dd449cb3bc79b109c117d9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vuzufexarevima/l._k._bennett_uk_size_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/setikizo/fases_del_aprendizaje_basado_en_problemas.pdfIn PDF document text
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_4b62a8e10a0543c99aadb1447637b69c.pdf?index=trueIn PDF document text
    • http://pinamagowejut.epizy.com/kipuxusutesubukebuweti.pdfIn PDF document text
    • https://3e80c8bf-0031-4ca1-bfa9-4484641fefed.filesusr.com/ugd/08103e_33edb08d4ae4492a91481f1f006b0b4f.pdf?index=trueIn PDF document text
    • https://9eff4bf0-55a5-42b9-a65a-250f23c32afd.filesusr.com/ugd/80978b_bfdd341080da4b898d85b7f015bb19c1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mejigavukolu/guided_tours_from_paris_to_lourdes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07f27c9e-81f7-4c1e-b65a-72ab003203a4/reburubemimivawupas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f65c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF65C 5304 bytes
SHA-256: 138d9a0b3759d38a1d0b26b9a953780b7c4d5473469b111169d14861c2e232e5
font_01_sfnt_off00010869.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10869 12120 bytes
SHA-256: 1c19101c4ac416562e7b09fa33c03e157b949b87fb622113fa38ab8011eb26c3

Open this report in the interactive analyzer, or submit your own file for analysis.