Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbede53c9ea9a6a4…

MALICIOUS

PDF

97.1 KB Created: 2021-05-21 22:44:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: c3cc64576287afa75b676b747a496781 SHA-1: 1fa24764a9140b8fd5b963ba8abce041530564f6 SHA-256: dbede53c9ea9a6a41e482e9ced94f4961b79a3baf518ebc0e13397440bf3c233
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector infrastructure, identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The ML classifier also flagged this PDF with a high probability of being malicious. The embedded URL likely leads to a phishing or malware distribution site, attempting to trick the user into clicking it by posing as a search result.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=what+type+of+mayo+does+wendy%2527s+use In PDF document text
    • https://static.s123-cdn-static.com/uploads/4496605/normal_5ff3fc75e6bd4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462678/normal_60610e3518dcc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487005/normal_6009a77086be0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446377/normal_5fe82d64659f8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465024/normal_604581692b31d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487424/normal_5ffdb7ca86513.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4503524/normal_5fe5dbeb282b5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zubuwujoxom/how_to_prepare_for_a_video_interview_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/vebisop/angular_server_side_template_injection.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d87edf8-9d9c-4103-a4f8-7c385b7f3e56/can_you_mix_rainbow_fish.pdfIn PDF document text
    • https://s3.amazonaws.com/sigobija/37405524981.pdfIn PDF document text
    • https://s3.amazonaws.com/nosepevozux/police_reports_cheyenne_wy.pdfIn PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/zebomijikevoruzir.pdfIn PDF document text
    • https://s3.amazonaws.com/xijuxosisomuna/chipmunks_birthday_song_video.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38fe8541-8a20-4679-9973-6843b04dd27c/85275868201.pdfIn PDF document text
    • https://s3.amazonaws.com/nezanurugega/exemplification_essay_template.pdfIn PDF document text
    • https://s3.amazonaws.com/fajixe/acute_rheumatic_fever_lancet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D3 6416 bytes
SHA-256: 528d1e79c27aec131c2cbf846536b85f4c117e3725d0fa982f5a85159cdab222
font_01_sfnt_off0000f7a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7A5 5396 bytes
SHA-256: e51359ba9e2fcfc136571b6fd21795260d8c4b5d62c5aae2ec69c9b9b4c21e7f
font_02_sfnt_off000109ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109FF 12144 bytes
SHA-256: d5baca12c771fa8c1c70d6ca4aca406e4613765af83a44b2465c67a47543a454
font_03_sfnt_off00013071.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13071 11236 bytes
SHA-256: 272da1ef4779de59252ab3087ae40cdd45a8e558ac4600091a9f32f8641223e3
font_04_sfnt_off000156a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x156A9 16256 bytes
SHA-256: 8cc6bcc2cf3defe0a88aedbd81e1c3d6ddceaf294630c8a268e5b6d92b2eedfb
font_05_sfnt_off00016c06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C06 1736 bytes
SHA-256: 0d9b6ab0354368cdfa5a4e52e4dfb250ede80cec4283e48fafec0a3c1c1d30df

Open this report in the interactive analyzer, or submit your own file for analysis.