Malicious PDF — malware analysis report

Static analysis result for SHA-256 9dfe98adb97b63fa…

MALICIOUS

PDF

89.8 KB Created: 2021-04-20 13:15:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4544cc96044ddfa75a8a38ad64d31ae3 SHA-1: a3045c4674d1d7bc01bf58003a58e44a62e6ccaa SHA-256: 9dfe98adb97b63fa4e162545c909f33695a092590ab0a66bd24946179d6ec0ad
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://yafferge.ru/strik'. This indicates the document's primary purpose is to redirect the user to a potentially harmful website. The ML classifier and ClamAV also flagged this PDF as malicious, reinforcing the phishing and redirection intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=multivariate+analysis+of+variance+test+in+spss
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • http://nejupike.mygamesonline.org/laxesivalekozikeroruvub.pdf
    • http://winoraama.site/buvawzaez9.pdf
    • http://creditscoreusa.info/ruwosazogimejorm4fb.pdf
    • http://ferategaj.scienceontheweb.net/podemetapifajeg.pdf
    • https://cdn-cms.f-static.net/uploads/4422133/normal_603724f28e548.pdf
    • http://bellissimo.online/what_percentage_of_hospitals_use_ehr0gejm.pdf
    • http://blacklaser.ru/yowhatsapp_mod_ios0gezx.pdf
    • http://hookup154.space/17556374516v3cgg.pdf
    • http://robot3.site/durogovifuwirah64x5.pdf
    • https://cdn-cms.f-static.net/uploads/4444366/normal_6037188fa17f8.pdf
    • http://wopizup.mypressonline.com/water_cycle_images.pdf
    • http://serviceforyou.site/crossfit_workout_of_the_day_app2cp40.pdf
    • https://cdn-cms.f-static.net/uploads/4366406/normal_6042b68e2d1ed.pdf
    • http://effektzhizni.ru/24439279693i950f.pdf
    • https://cdn-cms.f-static.net/uploads/4444357/normal_604e5654b31f2.pdf
    • http://stnold.com/xogojipitugalezafejunulantov2t.pdf
    • https://cdn-cms.f-static.net/uploads/4471235/normal_602a38e97978d.pdf
    • http://sweetygirl.club/13646723108i286x.pdf
    • http://hushseo.online/cspa_numeracy_test_answers_2018czu3u.pdf
    • http://yoga-fitness.space/88576485292t39r0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zugepoguj.onlinewebshop.net/vubidifulikiwogi.pdf
    • https://uploads.strikinglycdn.com/files/39c2d22b-a3fb-4d61-bf0c-f9ea8c3a9353/why_is_my_hvlp_spray_gun_spitting.pdf
    • https://uploads.strikinglycdn.com/files/21433023-2e4b-41a6-bd4a-08c58e6c70f4/59494008664.pdf
    • https://uploads.strikinglycdn.com/files/b12bfea1-2667-464a-ad02-e3196c8ee079/nitisifunogeturexi.pdf
    • https://uploads.strikinglycdn.com/files/ca12a1cb-77d5-47fb-8677-028c85b22060/pmd_clean_brush_reviews.pdf
    • https://uploads.strikinglycdn.com/files/5981eb2b-8c88-4c28-b5ad-d8516cf4b84c/who_wrote_the_book_of_the_bible_isaiah.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112cc.bin
21b66aa80f5bcfd812f4dc334d5794f47d2f5433dc1d8f0e2883e4b3519e27d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112CC 5060 bytes
font_01_sfnt_off00012422.bin
f29506d30f0fd75600e6a48dbd5d8d4964dc778ee2862acecdb75a82b6d6e77f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12422 10872 bytes
font_02_sfnt_off00014928.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14928 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.