Malicious PDF — malware analysis report

Static analysis result for SHA-256 31b6d3f2484bb737…

MALICIOUS

PDF

59.5 KB Created: 2020-12-07 22:53:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 6e7dfd4409df0265fd90a5013c8d5036 SHA-1: 1bf0905cb7da539e3f2d5bfc168e820ca5c61a06 SHA-256: 31b6d3f2484bb73704db403ff1fc2db3ea75a6ce3ab811c84c990cb13f72779d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://cctraff.ru/123?utm_term=star+wars+canvas+artwork'. ClamAV also detected it as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0'. The ML classifier strongly indicates maliciousness. The embedded URLs and document body suggest a lure, likely to facilitate phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=star+wars+canvas+artwork In PDF document text
    • https://static.s123-cdn-static.com/uploads/4384644/normal_5fc55f59cc9f2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402948/normal_5fc53ee32314d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418566/normal_5fbcd3420e445.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bevekizadoxuj/miwolozasabodojow.pdfIn PDF document text
    • https://s3.amazonaws.com/gozifep/soxajozenivufalemip.pdfIn PDF document text
    • https://s3.amazonaws.com/zabejuvijolu/should_or_ought_to_exercises.pdfIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/magic_mike_2012_shadow_dance_full_performance.pdfIn PDF document text
    • https://s3.amazonaws.com/memul/wibusudoj.pdfIn PDF document text
    • https://s3.amazonaws.com/vapelurowar/autocad_civil_3d_2016_training_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc77c63f59f035d0ccd600e/t/5fce10073ff1011540186c9c/1607340041681/juzibafixajukafavuwo.pdfIn PDF document text
    • https://s3.amazonaws.com/jewizopukuni/25757001122.pdfIn PDF document text
    • https://s3.amazonaws.com/faduxodiwo/44003906999.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5ada1c89e1c4b8fdf3d5c/t/5fc8bcc17ff5a343ebfc88dd/1606991043569/1218559047.pdfIn PDF document text
    • https://s3.amazonaws.com/timeziso/totatefi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ae0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE0B 5080 bytes
SHA-256: 0b35fea9527599aef4c21b52531a9507daca6d99666ed1bd4934f8887b79b5ba
font_01_sfnt_off0000bf79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF79 9936 bytes
SHA-256: aa67d9a05a5d61cf4f250c94a5cf225a77f5901ea0f5181188cdf2bb9d7dffca

Open this report in the interactive analyzer, or submit your own file for analysis.