Malicious PDF — malware analysis report

Static analysis result for SHA-256 13c56fffae72cbec…

MALICIOUS

PDF

43.5 KB Created: 2020-10-18 08:08:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: a4a173469fbaefd51617e2d1db4d4c5c SHA-1: 89a06d9c6a3ba692a15f632557f07925a93102b1 SHA-256: 13c56fffae72cbecbe72b4d1b4191433de0f995ac7b245990a79bf7e58a8e5c5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was identified as malicious due to its structure and embedded links. It contains a large number of external links, many of which point to potentially malicious redirectors or link farms, disguised as a book download. The primary malicious link identified is https://cctraff.ru/strik?keyword=the+maker%2527s+diet+book, which is flagged as a known malicious redirector. The document body itself is heavily obfuscated and contains remnants of the malicious URL, further indicating its intent to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=the+maker%2527s+diet+book In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365657/normal_5f8701cda6600.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368477/normal_5f8b4d25650cf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374372/normal_5f8979a1d78a0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/6493/1992/files/chaos_magic_book.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/1804/4070/files/35139453540.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e219ce46-54b6-430c-8688-e8030ab5c529/41986376691.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4116add-62b5-485e-b140-7595fe795e23/gajotoxuduwelolaxabakun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a4bc932-fa8e-45e0-84c6-1ac77a631739/kapomuwewiju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ee5e7f0-8587-47f0-91e1-c8a47a4b0e6b/wofixuxufuzutuwesudaku.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/6627/7534/files/rusty_bucket_nutrition_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/0613/8787/files/rosazadifojapizigagate.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/5852/7897/files/estado_de_prdidas_y_ganancias_estructura.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/505e748f-51f8-4b44-bb63-89e9b00ca986/78284779412.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6058caf9-9f6c-4ff2-8e7b-a577c9518c51/94459369561.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/4405/2885/files/maxaxif.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/0754/3965/files/24787969573.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/4365/9677/files/solving_multi_step_equations_kuta.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0464/9549/8392/files/how_to_graduate_high_school_early_in_arizona.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/5229/3541/files/cronicas_de_una_muerte_anunciada_libro_completo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006aa6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6AA6 5220 bytes
SHA-256: b0c3071e406966ead295cc234ae4ca886d1cb55a79f76eb4cb2164c7c92fdb7a
font_01_sfnt_off00007c3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C3F 10808 bytes
SHA-256: ab52d544d96041e544e9bcfdcb074ffdca6abc607b172830a7cd870f9ac84f7d

Open this report in the interactive analyzer, or submit your own file for analysis.