Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d133d8d3f5671c5…

MALICIOUS

PDF

77.4 KB Created: 2021-02-24 13:28:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1edb2bfd6df1ad556e490064b001979e SHA-1: 5b088f594d4ded293ae6752805f48b8af08fb4c5 SHA-256: 7d133d8d3f5671c5e67c37bafb9de5087f51d440b736f90514a0736e66dd32d4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating a phishing or malware distribution attempt. The embedded URL is disguised as a search query, aiming to trick the user into clicking it. While no scripts were explicitly extracted, the PDF structure and heuristic firings strongly suggest malicious intent, likely involving the download of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/123?utm_term=where+can+i+sell+my+ti-84+calculator
    • http://hookup157.site/banomoya_amapiano_remix_song29akn.pdf
    • https://cdn.sqhk.co/libibajuzumu/rgfgfcu/nihachu_fanart_l_manberg.pdf
    • https://cdn.sqhk.co/gupimupiset/ijj9giC/numberblocks_hide_and_seek_app.pdf
    • https://cdn.sqhk.co/rekutadis/jdjbAQu/ates_ve_su_2_kisilik_oyunlar_1.pdf
    • http://kellys.space/how_to_clean_quadrafire_santa_fe_pellet_stove6r6kh.pdf
    • http://vorgazme.com/70465259220qijad.pdf
    • http://oneshops.space/624637882971ls4d.pdf
    • http://creamwalls.online/204432162375ksue.pdf
    • http://vvinorama.fun/find_out_gmail_password_on_android_phonevnub0.pdf
    • https://cdn.sqhk.co/xokebuzizo/jWVOuen/78797017471.pdf
    • http://natlab.ru/los_2_periodos_de_la_historia_natural_dela_enfermedadxtvov.pdf
    • https://static.s123-cdn-static.com/uploads/4413126/normal_5fc6cf98ac023.pdf
    • https://cdn.sqhk.co/zulatobi/dzX1gwz/vikings_score_right_now.pdf
    • https://cdn.sqhk.co/lijipatalenu/aggdkny/new_english_songs_2020_dj.pdf
    • https://cdn.sqhk.co/sifajoxojif/j7jdKDa/tv_alphaville_noticias.pdf
    • http://lenudes.com/ridotaketofususomuxagiw65y4t.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/divexikav/82431577140.pdf
    • https://s3.amazonaws.com/dugibabafod/mobymax_answers_science.pdf
    • https://s3.amazonaws.com/xomudufe/xivugafojetelodis.pdf
    • https://s3.amazonaws.com/dezajok/60789355248.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c8e2.bin
13f6a9489729ee6baed307db2192f69a1ebccf24bbed76dbeee75cde3d794628		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8E2 5468 bytes
font_01_sfnt_off0000db2d.bin
f79b406abbccb1ab29540cbbdd2f1db6311e4f8fdc3f786763bb5e1b99346994		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB2D 6364 bytes
font_02_sfnt_off0000ead8.bin
441ba81ad3e1aed877fd3c11d9a0b66d83b8e65460b65c637b40b7e1233cb3c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD8 11480 bytes
font_03_sfnt_off000110d0.bin
7ccd8150e2c48a9748994740f2a0713563e2bc66516285f786c138bc0577823a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110D0 16088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.