Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9041450e675c88f…

MALICIOUS

PDF

88.4 KB Created: 2021-03-31 01:04:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: c0c5159ac90826e525b3f5ae9a9324b8 SHA-1: ea40b2ba2789e13e7f07894f65d473eb54b7005d SHA-256: f9041450e675c88fe51dbfaafe77449d4d0e2b3854e5709487c81fd6db852da7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://dafemum.ru/award?keyword=javascript+tutorials+point+pdf' is the primary indicator of this malicious activity. The ML classifier also flagged the PDF as malicious, supporting the overall assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8374

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=javascript+tutorials+point+pdf In PDF document text
    • https://static.s123-cdn-static.com/uploads/4369331/normal_5ffbaf663c6c0.pdfIn PDF document text
    • https://cdn.sqhk.co/vawapisoxe/9ridhdo/pilot_logbook_excel_template_download.pdfIn PDF document text
    • https://cdn.sqhk.co/fodexuxefeba/fiiBDhh/56353163105.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493579/normal_60546a5495342.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470218/normal_605982ac046d2.pdfIn PDF document text
    • https://cdn.sqhk.co/sepunaro/d1uifhg/balloon_dogs_art.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491669/normal_603513c129d2f.pdfIn PDF document text
    • https://cdn.sqhk.co/foseziwate/J2jbhjg/amazing_facts_sabbath_school_lessons_first_quarter.pdfIn PDF document text
    • http://suvuxivenorum.mypressonline.com/57932250378.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366664/normal_5fe7136b6895a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369903/normal_605bcbf40b0a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370062/normal_6063954192361.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wupixufekijax/how_to_draw_cool_but_easy.pdfIn PDF document text
    • http://wutorokanotomav.onlinewebshop.net/dcs_world_f-15c_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/vukujidor/african_american_heritage_hymnal_spiral_bound.pdfIn PDF document text
    • https://s3.amazonaws.com/tigovatolis/excel_function_list_sheet_names.pdfIn PDF document text
    • https://s3.amazonaws.com/wotodedaruzuk/is_eclipse_on_amazon_prime.pdfIn PDF document text
    • http://lopafulobitap.atwebpages.com/kukisexu.pdfIn PDF document text
    • http://kavuduvolilazod.myartsonline.com/concerto_for_2_violins_in_a_minor_rv_522.pdfIn PDF document text
    • https://s3.amazonaws.com/tamobalasu/cdc_flu_vaccine_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/alice_ai_foundation_free.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E83 4960 bytes
SHA-256: 0933daeaef70f0d1232bbba4b6ec8c9856ed7351f3180040e7bab7b294cc3a19
font_01_sfnt_off00011f60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F60 2332 bytes
SHA-256: 87f40291bfd598a3fb08a7443c92fa385f558a66f7e95af32467f99298fa03d7
font_02_sfnt_off000129ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129EE 11340 bytes
SHA-256: 6cb40997638c559ec49af9dbd57f58034cb3a2c53fa0682c93e6d30064e17e24

Open this report in the interactive analyzer, or submit your own file for analysis.