Malicious PDF — malware analysis report

Static analysis result for SHA-256 19100874e30bb255…

MALICIOUS

PDF

40.3 KB Created: 2020-11-03 00:43:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 3e15332fb0acc355e60ec8268b707ba9 SHA-1: 2ec102df86d7ada81e4c3b8858a6f2b2df577c08 SHA-256: 19100874e30bb2550bacbbd5f5ab9286a53e93cf789a2027e5d4f2dc22f83ffa
102 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to a known malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body also contains a URL that appears to be a lure for downloading a file, further supported by the SE_DOWNLOAD_BUTTON heuristic. The ML classifier also strongly indicated maliciousness. The primary IOC is the malicious redirector URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=bowling+king+hack+2019 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4422918/normal_5f9909b5c7fb7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425484/normal_5f9f7195420c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409998/normal_5f99f093e6cfd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381964/normal_5f99c3c4690d4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402032/normal_5f9245feef20f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365613/normal_5f98508b4f79f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369499/normal_5f8b8500a0fdc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424040/normal_5f9dfda8ec942.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c05690bc-c677-43fa-84cf-8ab236c0e0c2/pogajufet.pdfIn PDF document text
    • https://s3.amazonaws.com/vabedafozo/taco_007-f5_wiring_diagram.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e54abacb-36ce-4889-920a-d079cd28475a/walter_russell_books.pdfIn PDF document text
    • https://s3.amazonaws.com/zetare/22918037614.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f59d6664-adcd-4926-a46b-e540b6c58f61/soroptimist_international_of_the_americas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C3F 5472 bytes
SHA-256: 491dcb7ed90fcb91df1f27d497627e5625f7cdd8195d794e62be8409a78beb13
font_01_sfnt_off00006f06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F06 10844 bytes
SHA-256: b0863eea1a9bc9f0bfb7cef20437f150913afd97d23e83a4493abb80322254ca

Open this report in the interactive analyzer, or submit your own file for analysis.