Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb45786cc8b9c404…

MALICIOUS

PDF

76.6 KB Created: 2021-03-21 11:29:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: b64f523dc20909861d4e1f687fa3dc7a SHA-1: a76b5d55de64aedd53d4ed8976dd0724a6983277 SHA-256: cb45786cc8b9c40462d9c8e53d8b43de7d55b5c6b6db37b1b52e0368640d4c74
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a large number of embedded links, many of which point to external PDF files, suggesting a link farm designed to distribute malware or phish users. The primary malicious link identified is https://yafferge.ru/strik?utm_term=persona+3+art+book, which is flagged as a malicious redirector. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=persona+3+art+book In PDF document text
    • http://guzoseta.getenjoyment.net/4534955616.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4378152/normal_5ff2da80800c3.pdfIn PDF document text
    • http://jirenaxapibetig.scienceontheweb.net/57585449246.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379856/normal_60445e7d40264.pdfIn PDF document text
    • http://kapijozorok.22web.org/asciidoctor-_cover_page.pdfIn PDF document text
    • http://nutejujaxi.66ghz.com/queen_gambit_accepted.pdfIn PDF document text
    • http://derilezin.sportsontheweb.net/76625555573.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424405/normal_5ff37d8d8add7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tugumeb/bydureon_and_metformin_weight_loss.pdfIn PDF document text
    • https://s3.amazonaws.com/setigafat/how_to_grade_words_their_way.pdfIn PDF document text
    • https://s3.amazonaws.com/xujitezu/99874048429.pdfIn PDF document text
    • https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_71ade445f3434b96842f5a70c804e5e5.pdf?index=trueIn PDF document text
    • https://5e54d98c-4257-4cc7-9010-48f3df296eb2.filesusr.com/ugd/05240c_61a53a7e49ce4595a19ebeef605dced0.pdf?index=trueIn PDF document text
    • https://0879403c-3be5-48e4-925f-21334a7d5cfe.filesusr.com/ugd/407fcc_731af14fe4434221bdcf004c25dee0d5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/falufusu/kubota_svl75-2_oil_filter_location.pdfIn PDF document text
    • https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_2a91b4ef88f84768a55bc8a6495dc91b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dukavunivifa/mifojilowozunorokasojin.pdfIn PDF document text
    • https://s3.amazonaws.com/negonanopix/roku_earnings_predictions.pdfIn PDF document text
    • https://s3.amazonaws.com/fosalizuzu/grand_daddy_day_care_imdb_parents_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/kudufigunabi/best_cycling_app_android_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/lebejos/30149945687.pdfIn PDF document text
    • https://s3.amazonaws.com/jevelel/53918538288.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d615.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD615 7640 bytes
SHA-256: 3b81918e3fb6398a9841230f856eda66aa8eeec0de9392ae38a97391c14a765b
font_01_sfnt_off0000efae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFAE 5016 bytes
SHA-256: e0ad701b834ca87f7217bd2f8cb9fec67915aa1663a855d79e69501d87625c2c
font_02_sfnt_off000100cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100CF 10172 bytes
SHA-256: c74764ee9d1b684e1e72e3c132c6b13555af9bdf14acc44bfe50f237bf83d9df

Open this report in the interactive analyzer, or submit your own file for analysis.