Malicious PDF — malware analysis report

Static analysis result for SHA-256 1574757d8f976729…

MALICIOUS

PDF

41.8 KB Created: 2020-10-31 07:24:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 47eb4b03d7b122884e5cd5dc49ef97de SHA-1: e63319c2127bebb35381656a4764d9d4b87e4dc4 SHA-256: 1574757d8f9767290ea01116dfeb562d42531752d8f060f451cf4c3ac17fd235
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a heuristic firing for a malicious redirector link, which is also present in the document body. The ML classifier strongly flagged this PDF as malicious. The embedded URL is likely intended to redirect the user to a malicious site, potentially for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/pify?keyword=map+of+ravenloft+castle In PDF document text
    • https://fogoravirekan.weebly.com/uploads/1/3/4/3/134335139/7a0e9ed6f6a.pdfIn PDF document text
    • https://xoraxabaxid.weebly.com/uploads/1/3/2/6/132682630/4a38ae.pdfIn PDF document text
    • https://kawigijutugin.weebly.com/uploads/1/3/4/3/134351661/nutilapuwamoziv-voleru.pdfIn PDF document text
    • https://lowizozexide.weebly.com/uploads/1/3/0/7/130776176/6325140.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/dedfdd8a-5dff-48d7-9fc9-7d8b632d265f/58267280071.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/4850/4991/files/terirenu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d2eea74-a473-4559-91f6-d72ae8288f59/kovidade.pdfIn PDF document text
    • https://s3.amazonaws.com/fomaralunex/autocad_printer_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d73e57ac-0550-441f-86fc-f6904b5e89ed/mudagogivusijuboda.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/0464/0420/files/97864167411.pdfIn PDF document text
    • https://s3.amazonaws.com/waxapoz/beauty_standards_as_a_major_factor_of_depression.pdfIn PDF document text
    • https://s3.amazonaws.com/rotowan/esv_study_bible_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000056b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56B7 4812 bytes
SHA-256: afe8768e81d337b9616500bb2db63459f2aa5bceb7e33bcfa96224180390b21a
font_01_sfnt_off00006728.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6728 11056 bytes
SHA-256: 63175686d33fc49afa0cc285acfb13c6087debf4acfd7a1daddf94a527a0b68d
font_02_sfnt_off00008cb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8CB8 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.