Malicious PDF — malware analysis report

Static analysis result for SHA-256 30d64553221e2d5e…

MALICIOUS

PDF

42.5 KB Created: 2020-10-26 01:51:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-28
MD5: 9adee79d63db688ed4b9ba4f43fa78d2 SHA-1: cc20e08d0ab5cf905ce582cabed0a78fd2b2d15f SHA-256: 30d64553221e2d5e7a6ce970f30d150d4bee009bc3547ab9a2d3f4e9d8738a45
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for linking to known malicious redirector infrastructure, specifically the URL https://cctraff.ru/strik?keyword=thomas+calculus+12th+edition+t%25C3%25BCrk%25C3%25A7e. The document body, though heavily obfuscated, contains this URL and appears to be a lure related to a textbook. The presence of embedded URLs and the ML classifier's high confidence score indicate malicious intent, likely to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=thomas+calculus+12th+edition+t%25C3%25BCrk%25C3%25A7e In PDF document text
    • https://cdn-cms.f-static.net/uploads/4368504/normal_5f89161728bfa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408873/normal_5f9429d49a9bf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/af28ce76-3058-4218-953a-0a042c58dee7/wogojotevufu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/789e60ed-05db-46ef-ab73-98947a2295dd/fejilusuguz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc0c4734-5051-4eac-9769-798adb019f99/23428317360.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a4245f4-d90d-420c-9aa3-dad660d1cf7e/19094437925.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/h_pylori_tratamiento.pdfIn PDF document text
    • https://s3.amazonaws.com/wonoti/viwatoza.pdfIn PDF document text
    • https://s3.amazonaws.com/kewakuko/85877838542.pdfIn PDF document text
    • https://s3.amazonaws.com/zonebon/rutefisevibibonotagudud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf9dbeaa-29dd-4bc4-8abb-8442035dfb67/liseperuzizon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ce2592f-f79c-440d-86b9-2f20854e2a02/73885494530.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fab2be3b-d537-4ddd-bd4a-acf5222b4714/filuxekoke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a05aea15-eb37-486c-b8d4-808753ec8239/the_encyclopedia_of_biblical_errancy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec4589c3-e94a-4d34-8c8d-d91d74cd26ac/john_deere_145_plow_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/53977705522.pdfIn PDF document text
    • https://s3.amazonaws.com/loxopudizus/tixupal.pdfIn PDF document text
    • https://s3.amazonaws.com/ladojenefe/7676010160.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2108e01-427c-4c15-beb6-cbacbd95a8ba/6241584175.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d303049d-dc9f-41ee-97fa-5ca7c504b89c/26521542163.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006632.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6632 5676 bytes
SHA-256: 6d794b2070d10c030ae59e6cc1978eaf9b1b590d381845250f20f13f43242d2e
font_01_sfnt_off000078dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x78DD 10092 bytes
SHA-256: 48af307c88305ad4884f6ccb72de073c8d79b087c5cb4e37c713525c0e34a74f

Open this report in the interactive analyzer, or submit your own file for analysis.