Malicious PDF — malware analysis report

Static analysis result for SHA-256 23df9f52a9295a1e…

MALICIOUS

PDF

779.0 KB Created: 2020-10-30 09:03:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 11a6a135a2015fba34915b498a3288f4 SHA-1: 4a6277cc068f9eb305016a6479a5d7d55f0f5eba SHA-256: 23df9f52a9295a1e91e336863802d6529919bfd4bc8710747aec675e42ce7a45
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text that suggests a lure, potentially related to 'Overlord volume 10 audiobook', and the SE_URGENCY_LURE heuristic also fired. The ML classifier strongly flagged this PDF as malicious. The primary IOC is the malicious URL used for redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9355

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=overlord+volume+10+audiobook In PDF document text
    • https://cdn-cms.f-static.net/uploads/4388596/normal_5f9adc43e2ec7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366385/normal_5f8ad6000b9cc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391315/normal_5f8fb3dc193ce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414353/normal_5f976d6cc3929.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365599/normal_5f870a2526fa3.pdfIn PDF document text
    • https://rugurujumififez.weebly.com/uploads/1/3/1/3/131384765/junotake-mavaxofili-pinopoba.pdfIn PDF document text
    • https://dejolezeg.weebly.com/uploads/1/3/2/8/132815968/fefeza_jojosara_bezilajap_baxigomewese.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382189/normal_5f98cee3c2a06.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420224/normal_5f96a3dd4d334.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376371/normal_5f94a8c39d814.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368750/normal_5f8d0b6541092.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kudowo/o_neoliberalismo_histria_e_implicaes_david_harvey.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/192b867b-bb7c-473f-bcf0-f1bdb6f5f2a7/83256785957.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67d158db-79d7-4c16-8801-5c82c8a7582e/61219229179.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000bcbd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBCBD2 4204 bytes
SHA-256: d6cf6d3d12309bc751980cb9cc91cc0e31481e8cf872e1e7326b40837c6d9e83
font_01_sfnt_off000bdab9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBDAB9 5280 bytes
SHA-256: fde19b8ba4fbbc982fdeef42c0a4df27a81c4f398f25c91416bc6156e09d90a2
font_02_sfnt_off000beca0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBECA0 14224 bytes
SHA-256: 7cd5886f9c1cf9710623a5d2074652ad6e6e7c5bc5caad7a233ecb3645385724

Open this report in the interactive analyzer, or submit your own file for analysis.