Malicious PDF — malware analysis report

Static analysis result for SHA-256 e73db516097c114d…

MALICIOUS

PDF

78.6 KB Created: 2021-03-21 03:10:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 39287f996e8f3b3a9de353b17bef81ce SHA-1: 21b364d2d1b9da067318a9be7e56745a3d7f3c30 SHA-256: e73db516097c114dcdbd2dfd7adba635910f5710d8df9d1d88fe78b71d89b9c3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a malicious redirector link pointing to 'https://yafferge.ru/award?keyword=cash+flow+example+pdf', which is flagged as critical. ClamAV also detected the file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0'. The document body, though heavily obfuscated, suggests a lure related to 'cash flow example pdf'. The presence of embedded URLs and the critical heuristic firings strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=cash+flow+example+pdf In PDF document text
    • http://coolvdomaion.online/mathematics_workbook_for_class_6vobea.pdfIn PDF document text
    • http://davebamonuzove.medianewsonline.com/sunshine_fading_away.pdfIn PDF document text
    • http://bufibinokurun.scienceontheweb.net/77640535360.pdfIn PDF document text
    • http://acgmgroup.ru/bhojpuri_video_gana_ing_filmuw94m.pdfIn PDF document text
    • http://podeves.xyz/mapa_de_asia_sin_nombres_para_imprimir4a7t5.pdfIn PDF document text
    • http://about-igsupport.com/vertical_farming_technologyro7ov.pdfIn PDF document text
    • http://piwulag.sportsontheweb.net/lurarebipijididafam.pdfIn PDF document text
    • http://crispyset.online/lupabepuzudasunab5at5.pdfIn PDF document text
    • http://nariwunuzaw.scienceontheweb.net/bibliographic_control_tools.pdfIn PDF document text
    • http://avtovishki-msk.ru/buderus_g215_manualtaebm.pdfIn PDF document text
    • http://7evenrp.ru/xbox_360_controller_rechargeable_battery_pack_not_working4iri3.pdfIn PDF document text
    • http://limecash.xyz/1993_cadillac_fleetwood_brougham_owners_manualgfzho.pdfIn PDF document text
    • http://gtmedis.com/vejejeletlwr.pdfIn PDF document text
    • http://nokojatagi.mywebcommunity.org/40775111074.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dolanuvusipegu.myartsonline.com/56223202240.pdfIn PDF document text
    • http://tirigofov.atwebpages.com/18685444269.pdfIn PDF document text
    • https://s3.amazonaws.com/putelekireza/meditation_music_piano_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/vipinib/adobe_reader_scanner_free.pdfIn PDF document text
    • https://s3.amazonaws.com/mexijegedakol/agv_automated_guided_vehicle.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/hp_compaq_8000_elite_cmt_specs.pdfIn PDF document text
    • https://s3.amazonaws.com/tinezedu/83141327690.pdfIn PDF document text
    • https://s3.amazonaws.com/gavobawum/sinopsis_novel_hunger_games_catching_fire.pdfIn PDF document text
    • https://s3.amazonaws.com/kavifunaruvi/45676367779.pdfIn PDF document text
    • https://s3.amazonaws.com/piwupevivotixi/11278955655.pdfIn PDF document text
    • https://s3.amazonaws.com/nosepevozux/pijalifefubozarep.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f577.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF577 5248 bytes
SHA-256: 275e3e6ac162460cfcde19f87efa1ae0f46b205fe873a9e4a58c4f0f007c4f25
font_01_sfnt_off00010745.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10745 10956 bytes
SHA-256: 51769f1ed1dd7eaa9d59aef57239ebb1bb99b179f5d6fe544919a05ba8860982

Open this report in the interactive analyzer, or submit your own file for analysis.