Malicious PDF — malware analysis report

Static analysis result for SHA-256 b32344cbf31640fa…

MALICIOUS

PDF

75.7 KB Created: 2021-03-24 03:54:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: c96d3b475cee0c2184eb810ca6eb567a SHA-1: 77e79f5574efcd91f38b88214ec71628f249031d SHA-256: b32344cbf31640fa72a9aab85ac8df574cfe75ab32fdbe24efb0bc093044d91a
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file is identified as malicious due to its inclusion of a large number of external links, many of which point to potentially malicious redirectors or link farms. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' specifically flags a URL leading to 'yafferge.ru', indicating a probable phishing or malware distribution attempt. The ML classifier and ClamAV detection further support the malicious classification, suggesting the file is designed to exploit users through deceptive links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=aldington+death+of+a+hero+pdf In PDF document text
    • https://vufujisuwe.weebly.com/uploads/1/3/1/4/131437295/4ee3c5c06170e8a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458412/normal_605a67d89cada.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368964/normal_5ff1429e659df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4530910/normal_602f9b3732ace.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454995/normal_5fc78feac85a5.pdfIn PDF document text
    • https://movimuwetimegi.weebly.com/uploads/1/3/4/3/134342740/fozas.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457281/normal_6035025d2150c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/17337070636.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d52ae62c-b41f-4fda-8508-abed63731878/hidden_blade_blueprints_dual_action.pdfIn PDF document text
    • https://s3.amazonaws.com/labitajaxatufib/discrete_seekbar_android_example.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74bf7b26-f556-4abc-9b19-23b09b91dfd4/20615248560.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b222b39-6ac6-4e8e-88fe-01c583d16160/speedy_maths_tricks_in_hindi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a12ae6b6-46b4-479a-a8a1-55aed7fdc6ed/what_is_the_next_dog_man_book_going_to_be_called.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2778918b-8dc0-4f34-b9c8-0baef32b0395/koludadetolamowozu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48e0e70f-8170-4d82-a82a-75e1ae6ee40e/what_myers_briggs_types_work_well_together.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/395091ee-5497-487a-922a-7bdf1f3852ba/cant_feel_empathy_or_sympathy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7ae5728-408f-429b-8c0a-7b48ee371245/pamusewud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bed2d797-91ad-4ac4-a4c5-6b2a0f246146/zezufopupijanos.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e966.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE966 5116 bytes
SHA-256: a30c3a5f5d217096dd6dda8e75af35aa434973218c86fb18e8b0e3af8bac10f5
font_01_sfnt_off0000fac8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAC8 11468 bytes
SHA-256: 7096af89dde9792d7f721562b6f3fc6f3cb835e3a56ebded81615f0978891d01

Open this report in the interactive analyzer, or submit your own file for analysis.