Malicious PDF — malware analysis report

Static analysis result for SHA-256 c80acd3e09f945a1…

MALICIOUS

PDF

77.8 KB Created: 2021-03-25 01:07:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 4101a2d73e2bdcedec4228b3e3b68651 SHA-1: d6c09c40b58d7ab9b4aeee5ce4c5308ed5904efc SHA-256: c80acd3e09f945a13b5f74b2a04f7121cc71cdc68e772d554c1d3a7ce5e10299
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://yafferge.ru/award?keyword=selling+on+amazon+for+beginners+pdf'. This indicates the document's primary purpose is to redirect users to a potentially malicious site. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', further supporting its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=selling+on+amazon+for+beginners+pdf In PDF document text
    • http://bikokobolo.sportsontheweb.net/newugalomebosa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416661/normal_60124f3ab426c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422890/normal_601ee65949150.pdfIn PDF document text
    • http://bopolubolef.mywebcommunity.org/bitusexekigawado.pdfIn PDF document text
    • http://susekilimu.medianewsonline.com/excel_cheat_sheet_2020.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454167/normal_60044b3e00e5a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://788ae96d-7a4f-4726-91a9-07bb742fb3e7.filesusr.com/ugd/97aff7_5c536bdc051d4e30a4683ffcfa9618cf.pdf?index=trueIn PDF document text
    • https://486bfeb6-87d8-40a3-812f-3449909c9139.filesusr.com/ugd/81b904_c1b7fa52163f4a5a853dacce4d11e359.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/de53c680-8874-416e-90f2-2b7dd95126d4/who_are_twitters_competitors.pdfIn PDF document text
    • https://75e6d08a-b14f-4c2c-bd4e-3e6431d9d11c.filesusr.com/ugd/497a87_153c68b0529845f5bdc0f60e7b0b8284.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/janodojivi/android_version_8._0_update.pdfIn PDF document text
    • https://s3.amazonaws.com/xasovewipeje/shooting_star_candlestick_formation.pdfIn PDF document text
    • https://459fb65c-52af-4c88-885a-43a44fbeaf25.filesusr.com/ugd/6a7407_7ac3d31be7044e52825b6251978d10bc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nisiwanolom/cfa_level_1_book_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5d246c3-74da-4132-be21-ecb29251af2c/how_to_reset_traxxas_trx4_transmitter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/996a5ddc-c307-419d-8760-4ea40a962b55/prince_of_persia_full_movie_download_filmyzilla.pdfIn PDF document text
    • https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_007e81040dab459998234b4928a660f7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/50143c96-38d4-4dd0-aab0-cf36fffb4bd1/22071773532.pdfIn PDF document text
    • https://s3.amazonaws.com/jawusawar/parvatichya_bala_video_song_free.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/63431175370.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f042.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF042 5652 bytes
SHA-256: c885aa1829265a8d2a43703dcf3a510ad0d1074a92012cfca523578d770417e5
font_01_sfnt_off0001036f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1036F 11244 bytes
SHA-256: 059779d25254fa9da50b642e39270834a80d1894471ced925f0dfa06866867a5

Open this report in the interactive analyzer, or submit your own file for analysis.