Malicious PDF — malware analysis report

Static analysis result for SHA-256 1420a382323bea94…

MALICIOUS

PDF

72.1 KB Created: 2020-12-25 21:41:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4b814373fa7cf47a33ef5318bc8baf48 SHA-1: d6605558d66b93d99164eb405435e4110441f700 SHA-256: 1420a382323bea94611282538d3faec1adcf4cdbfe9c656520508d0b2874922a
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by multiple heuristics as malicious, including a critical finding for a redirector link to known malicious infrastructure. The document body and heuristic firings strongly indicate an advance-fee scam lure, aiming to trick the user into clicking the embedded URL. While no scripts were explicitly extracted, the PDF structure and malicious link suggest an attempt to download a second-stage payload or redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=rescue+mission+thrift+store+durham
    • https://cdn.sqhk.co/wiluxuko/SspPXTq/2d_shapes_games_online_free.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5034204a-4449-429d-86ee-ba085b2b113b/faxoragoxedaj.pdf
    • https://uploads.strikinglycdn.com/files/504ff305-cad0-4337-9d7d-627d24ea4401/22800976039.pdf
    • https://uploads.strikinglycdn.com/files/d427ed65-e742-4b53-b376-d1ec704a9962/kiruxojodilaku.pdf
    • https://s3.amazonaws.com/padadutiseni/42041404098.pdf
    • https://uploads.strikinglycdn.com/files/8bcb3072-9111-4700-9b11-0d7b0473b2f4/velozes_e_furiosos_2_filme_completo_em_portugues.pdf
    • https://s3.amazonaws.com/feseni/reliance_capital_annual_report_2014-_15.pdf
    • https://uploads.strikinglycdn.com/files/f96655f0-072a-4704-aa19-948db9dc93f6/13061035685.pdf
    • https://s3.amazonaws.com/nonabafat/zaturije.pdf
    • https://uploads.strikinglycdn.com/files/df30dcf4-7477-4c72-b49b-87879803eae8/bellsouth_net_home.pdf
    • https://uploads.strikinglycdn.com/files/d74caef4-a187-4009-84a6-ca30eeb8215d/44557328547.pdf
    • https://uploads.strikinglycdn.com/files/54ef8434-961e-4099-87a2-134ae98876f1/50529630773.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db84.bin
3b8dd559725d7c5cdbd499dc6aa70b3b73d73e5ba83ea5d4b105f591c9232b74		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB84 5236 bytes
font_01_sfnt_off0000ed29.bin
930239666dfaf517450e1314f625acb990dbee45968bc4f2eb0eda4e09390920		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED29 11284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.