Malicious PDF — malware analysis report

Static analysis result for SHA-256 9622ad8d873b1362…

MALICIOUS

PDF

74.7 KB Created: 2021-04-01 00:15:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 896edffe9df77f0f40a7c642ed7e26c9 SHA-1: afd4010bbafc6042b8b022a1533aba716d9178c1 SHA-256: 9622ad8d873b1362d4248319210e89d86cff1803d2362ac4975eacbdb20b0aa8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/award?keyword=ca+books+pdf+free+download'. This URL is presented within the document body, disguised as a free download link. The ML classifier also flagged the PDF as malicious with a high score. While no scripts were extracted, the presence of a malicious URL within a PDF, combined with the heuristics, strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8829

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=ca+books+pdf+free+download In PDF document text
    • https://cdn-cms.f-static.net/uploads/4486758/normal_6024ad135cccd.pdfIn PDF document text
    • https://lixojubenolida.weebly.com/uploads/1/3/4/3/134375882/pumedo-dozunixesib-guvedadefida.pdfIn PDF document text
    • http://kewatupu.scienceontheweb.net/breast_cancer_staging_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/zikufivol/79NjIjc/live_cricket_match_streaming_app_free.pdfIn PDF document text
    • https://nedetuvozuwe.weebly.com/uploads/1/3/4/6/134699612/6931929.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467017/normal_6020fa7cea1ff.pdfIn PDF document text
    • http://vekenuv.iblogger.org/drawing_on_the_right_side_of_the_brain_courses_uk.pdfIn PDF document text
    • https://tatisosef.weebly.com/uploads/1/3/5/3/135333589/6047638.pdfIn PDF document text
    • https://cdn.sqhk.co/penavagalo/znEibhc/vumibevuzibuzuguziwos.pdfIn PDF document text
    • https://sobasoje.weebly.com/uploads/1/3/2/6/132695832/04f9d41.pdfIn PDF document text
    • https://cdn.sqhk.co/tuledapozato/hjcbIgh/cheap_flights_to_hawaii_from_sfo.pdfIn PDF document text
    • https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/xafagubuzegadufaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gogoxowiniza/16398293544.pdfIn PDF document text
    • https://s3.amazonaws.com/muvemasoxaji/archer_c7_setup_guide.pdfIn PDF document text
    • http://ribezewipuzez.epizy.com/zafezasifabemawi.pdfIn PDF document text
    • http://kojuvurapamox.myartsonline.com/pavanevisejokuvub.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/how_to_descale_saeco_royal_coffee_machine.pdfIn PDF document text
    • http://lowuguja.myartsonline.com/a_merveille_1.pdfIn PDF document text
    • http://voposopaxemef.rf.gd/zadukaduwiliparon.pdfIn PDF document text
    • https://s3.amazonaws.com/pulavokaxe/australian_tax_invoice_template_free.pdfIn PDF document text
    • https://s3.amazonaws.com/kexamoxusinixu/titan_440_paint_sprayer_filter.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f60b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF60B 5236 bytes
SHA-256: 9513103f9ea1b9fd9e5afe17df2d838bb6993270d66cec4ed0258a4cda472add
font_01_sfnt_off000107f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F3 11196 bytes
SHA-256: 658ad1557f7759cde443a5285c85991fdcd036459946642ee2c02b873a415769

Open this report in the interactive analyzer, or submit your own file for analysis.