Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0bfc79f596787e8…

MALICIOUS

PDF

85.8 KB Created: 2021-02-20 23:43:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: d83744fd96bd36366e2170b304da9230 SHA-1: 693b7b8abe23754bd40bc39992f6dc2596d60ae8 SHA-256: c0bfc79f596787e8987b21fbab81d77543aa7b289d3502f51a43c0ca898d778a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/123?utm_term=how+to+share+a+video+from+twitter+to+fb'. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0'. The ML classifier strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains text related to sharing videos, potentially as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/123?utm_term=how+to+share+a+video+from+twitter+to+fb In PDF document text
    • https://cdn.sqhk.co/zutoruxutu/cgGAKha/tennis_azarenka_net_worth.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393033/normal_5ff1b75ebe7eb.pdfIn PDF document text
    • https://cdn.sqhk.co/rewazexi/Sxibqgd/zozosipatalozedobux.pdfIn PDF document text
    • https://cdn.sqhk.co/difixoruze/lPmiggi/pevoje.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445880/normal_5fda8beac4103.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368221/normal_5fd64f2fc43df.pdfIn PDF document text
    • http://100p-f.ru/sopoxuzozazajimujojamo21n43.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tokatefozude/23386665583.pdfIn PDF document text
    • https://s3.amazonaws.com/megujobemegor/what_could_have_been_done_better_answer.pdfIn PDF document text
    • https://s3.amazonaws.com/nitirew/deriludelutelotanewul.pdfIn PDF document text
    • https://s3.amazonaws.com/zoluwivebiro/sebemobikisefuvev.pdfIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/84236839673.pdfIn PDF document text
    • https://s3.amazonaws.com/begijufadi/metedifuwazonawamam.pdfIn PDF document text
    • https://s3.amazonaws.com/zuwimadaneb/91719061677.pdfIn PDF document text
    • https://s3.amazonaws.com/miwolezedubujoz/self_contained_breathing_apparatus_training.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0BF 5368 bytes
SHA-256: 57f06c5f063ec098c0474c39f5ba861a24be5870aa7a9524499285b8e61723a0
font_01_sfnt_off0000f2e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E3 8184 bytes
SHA-256: 4e194a27981473ebd2309dff6c03b0dd68f771649db1c5429bb7b469d96b203f
font_02_sfnt_off00010936.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10936 11508 bytes
SHA-256: df942db65c5b91b77b7a8fa275d6ffd9f2c58464051067fafc9e93360bc1acbb
font_03_sfnt_off00013079.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13079 17096 bytes
SHA-256: 9a73e35fd158bd23e7ebc701902b6e2c5975cfb968036478fb9bc76b5e98a123

Open this report in the interactive analyzer, or submit your own file for analysis.