Malicious PDF — malware analysis report

Static analysis result for SHA-256 845cefc3b19dda19…

MALICIOUS

PDF

84.7 KB Created: 2021-03-13 20:52:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18ca27ce81676995744abd3a5f9a801a SHA-1: 205cd934f94c19680caf305a561ae35b8050218b SHA-256: 845cefc3b19dda19cfdd48f8f66380a97049ae34ffb32e3936a73e8c962ec8ef
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/award?keyword=trueman+biology+book+pdf+download'. The document body, though heavily obfuscated, contains text related to 'Trueman biology book pdf download' and application metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content. This, combined with the ML classifier and ClamAV detection, strongly indicates a phishing or malware distribution attempt disguised as a document download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=trueman+biology+book+pdf+download
    • http://jarewitof.mypressonline.com/motorola_xtl_5000_power_supply.pdf
    • http://ketotreno.buzz/55643655631phpyf.pdf
    • http://mujododaziwato.scienceontheweb.net/wuwesomiliredutasoxe.pdf
    • http://mosuxuvemuzuwex.mywebcommunity.org/37106993730.pdf
    • http://leafester.online/head_first_javascript_programming_a_brain-friendly_guide_freedc7xx.pdf
    • http://raisinshub.pro/10667659332harc5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5fc92d34-e8f4-46e5-a480-dfdf19642748/guwamumas.pdf
    • http://sugorotebego.epizy.com/21898092602.pdf
    • https://s3.amazonaws.com/viromibukoleliw/family_members_pictures_worksheets.pdf
    • http://nizofikunatafu.atwebpages.com/list_of_all_aircraft_types.pdf
    • https://uploads.strikinglycdn.com/files/9fc74431-84ac-4646-a681-10cec2448ef4/roliwolapu.pdf
    • http://birenogidovolus.rf.gd/xatipeloxupo.pdf
    • http://bomapogixojepo.epizy.com/wumig.pdf
    • http://ponuruv.rf.gd/bt_hub_5_instruction_manual.pdf
    • https://s3.amazonaws.com/getizar/venice_city_map.pdf
    • https://s3.amazonaws.com/tezude/multiplication_worksheet_grade_4_printable.pdf
    • http://takoxun.epizy.com/mifojemekonoporaju.pdf
    • https://s3.amazonaws.com/jaxesabi/line_6_spider_iv_75_amp.pdf
    • http://jewofeket.onlinewebshop.net/19751641785.pdf
    • http://nebaxowowugi.rf.gd/dt466e_injectors_in_7.3.pdf
    • https://uploads.strikinglycdn.com/files/09b45a2c-e187-4a39-89d8-08c7ca3df9b8/firigivudeluw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed15.bin
ee7b636678ca1c09c250e5354bdf86bab063ac1f5c429791f2be7123aed0f2d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED15 5532 bytes
font_01_sfnt_off0000ffdb.bin
8db65adc699bed2ed4e99b174e414cace916d9ae25f4e5597e3d94de4d1667c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFDB 2116 bytes
font_02_sfnt_off00010983.bin
515b2f654b2b93e03a2cafef750f85fd4338fe1eb4fa03cef6cb22cea3da3e33		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10983 11196 bytes
font_03_sfnt_off00012fb3.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FB3 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.