Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5a11094c4affd1c…

MALICIOUS

PDF

79.2 KB Created: 2021-06-07 01:01:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: c206413e7d587d24b6458c29b62ba425 SHA-1: 92737cbf5b910d34164502a2812ecf607b983c0d SHA-256: c5a11094c4affd1c518d65e3dcabaaae9e8c785a19c0de8728a02aa74ebbcd7e
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojanized document. A critical heuristic identified a link to known malicious redirector infrastructure, specifically 'https://yafferge.ru/123?utm_term=texas+dmv+questions+and+answers+spanish'. This suggests the document's primary purpose is to redirect users to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/123?utm_term=texas+dmv+questions+and+answers+spanish In PDF document text
    • https://static.s123-cdn-static.com/uploads/4369793/normal_5ff16f9bd59a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494436/normal_5fd95ea0a3112.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4528959/normal_6040bb63407bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461204/normal_600b79fd1d3f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426571/normal_6037e430ac60c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496170/normal_605152e0dc263.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476596/normal_603909bfdb2cf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476434/normal_60107ca65d2c6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449793/normal_60049afd9f6b6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484835/normal_5fe8ed953d808.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404984/normal_6054aac14772b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387040/normal_601037fab3a03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471235/normal_600b9b2940244.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452161/normal_602ca8c39855a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369781/normal_5fd3a8346f136.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4410695/normal_60054ba37789f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://luwosotatex.pbworks.com/w/file/fetch/144656232/mopujalexoxanenew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49937d05-9739-429a-bf5f-332d7ebd7635/warcraft_3_reign_of_chaos_patch_1.27_a.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51ab5ccb-2bf3-4588-94e7-846af3760256/35482747969.pdfIn PDF document text
    • http://bekivuxuga.pbworks.com/f/evaluating_numerical_expressions_with_exponents_worksheets_answers.pdfIn PDF document text
    • http://labidan.pbworks.com/w/file/fetch/144570711/nexululozibasedomugaxe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebe96b11-31ae-4bc8-ab99-80f2398b8626/what_is_the_best_android_programming_language.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e952.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE952 3580 bytes
SHA-256: 9c2cd4427faa214e2f1c324abc1ac25a26a9b066c9bef1e5b99534655de47abd
font_01_sfnt_off0000f618.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF618 5460 bytes
SHA-256: 20401404070cd344a816915ccf4d277eb886994be0a4489cb740aa44d5ec5609
font_02_sfnt_off00010892.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10892 11576 bytes
SHA-256: 9364678d6d0c3a7fe9e9462a609e94108daa4f37505c938b613ebdfb63b24933

Open this report in the interactive analyzer, or submit your own file for analysis.