Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff33b2eae16f282d…

MALICIOUS

PDF

83.0 KB Created: 2021-05-18 22:10:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ba949e79ddc2befec94342c59339cb06 SHA-1: ed6d5d90247df319a7f2b4510668693456519845 SHA-256: ff33b2eae16f282d6665e6b5ee5fed27c83cea416cdca448fdc5e10322390fde
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing a link to a known malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier and ClamAV also flagged this file as malicious. The embedded URL https://yafferge.ru/strik?utm_term=offenses+vs+1-3-1+zone is the primary indicator of malicious intent, likely leading to a phishing page or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=offenses+vs+1-3-1+zone
    • http://pokipejixube.22web.org/sanskrit_baby_boy_names_with_meaning.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ginokiximoz.rf.gd/asco_catalog_solenoid_valve.pdf
    • https://uploads.strikinglycdn.com/files/db9e7ca3-dbf3-4767-be9f-8ec330f1a6ac/network_guide_to_networks_8th_edition_review_questions.pdf
    • http://wuwalumawaj.rf.gd/letter_of_reference_templates_free.pdf
    • http://vonolukover.epizy.com/cireson_portal_install_guide.pdf
    • https://uploads.strikinglycdn.com/files/70609fe9-eee0-4d07-84d1-c080f6e85a32/5049188568.pdf
    • http://wepebodup.rf.gd/24123066553.pdf
    • https://uploads.strikinglycdn.com/files/e87e4e08-518a-4818-95ac-4ac6f993ec2c/oracle_12cr1_end_of_life.pdf
    • https://uploads.strikinglycdn.com/files/b220af92-638d-4d90-b2e9-a74e555f3922/best_picture_settings_for_samsung_q90t.pdf
    • https://uploads.strikinglycdn.com/files/097567e3-b99b-47cd-a0c8-69643b929064/26330647077.pdf
    • https://s3.amazonaws.com/rekawexuretowo/26091364590.pdf
    • https://uploads.strikinglycdn.com/files/46d34c12-3134-481e-8541-36b25bebcf86/19975486160.pdf
    • http://xaderuk.epizy.com/agile_estimating_and_planning_mike_cohn_free_download.pdf
    • https://uploads.strikinglycdn.com/files/6ce49952-97ec-4abb-8ac7-8e4c32419d8a/3897456980.pdf
    • http://mefowoweman.epizy.com/what_does_a_aficionado_mean.pdf
    • https://uploads.strikinglycdn.com/files/f8fdb7e5-eb67-4c07-b71b-5d4c2d31d7e7/97815292806.pdf
    • https://uploads.strikinglycdn.com/files/fe8ed500-e597-4b91-b65f-24f14db92225/the_stand_season_1_episode_2_time.pdf
    • https://s3.amazonaws.com/ninasivol/binamebijajuwapumu.pdf
    • https://s3.amazonaws.com/jobavo/vuvedolotevuzosotin.pdf
    • https://s3.amazonaws.com/robumuduluwise/82714724077.pdf
    • https://uploads.strikinglycdn.com/files/02f6b1bd-07a7-43c3-be94-35162d8f8d62/how_to_clean_cuisinart_ss-15.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105bf.bin
a14accbf681497fa71ee10ddb3bc35cff666aaa943a4b01b0b8c4b7809020bb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105BF 4808 bytes
font_01_sfnt_off00011658.bin
dafbe2686c27b33efed3ac7feea1c7ee48b75b44da60c0055fafefdaeb80f721		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11658 11444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.