Malicious PDF — malware analysis report

Static analysis result for SHA-256 0851e2c24fa6ea19…

MALICIOUS

PDF

43.8 KB Created: 2020-11-04 15:30:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 4bf0f768f740d28247f58f43991615f5 SHA-1: 9629331bcdc1f3761b1d7e931cd5be314df04fd9 SHA-256: 0851e2c24fa6ea19a08286bf4510e3a1f77b33aaf78713ab03793e884543b5bb
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. It uses a password-protected-archive lure. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=dear+mr+henshaw+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4383146/normal_5f9415d0b155d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417809/normal_5f9ca0c68b6a2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f82006b-1361-406e-953f-7514dacaabac/87437717405.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ad7158f-36e6-4e7b-8322-08da2498fda2/cox_channel_lineup_phoenix_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/genedonapubefe/rv_awning_lights_exterior.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a9b8153-cac8-4443-9632-474d12d98f2b/radasijunigux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fef2a583-348c-4baf-8100-c1a9ad1008b2/42470969571.pdfIn PDF document text
    • https://s3.amazonaws.com/jofunozuzof/multivariate_data_analysis_in_r.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01bc29d2-4d81-479f-8dac-96185cd4b228/relacion_hombre_naturaleza.pdfIn PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/40377791121.pdfIn PDF document text
    • https://s3.amazonaws.com/jedobufudajewu/34412424495.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa162765-f533-451b-8b62-3c1f3d408358/52177246303.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68c6f173-03ee-416f-bd24-74686d9ab1d1/16350744842.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e4038f0-2bdd-4fd2-a48d-46b5f0b36e0e/jixabis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/834fa27f-e46c-49ac-bdb9-39b40de8ff95/72237216307.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b71.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B71 5340 bytes
SHA-256: 04586629179e923249dd1167a306f643719f47562861f4ed07e8abe2a0fbe5a9
font_01_sfnt_off00007d88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D88 11312 bytes
SHA-256: eaea67d364bdbf4c1ea8c3e144edb528a7db7f6f04f27ae147d38098e3098ea1

Open this report in the interactive analyzer, or submit your own file for analysis.