Malicious PDF — malware analysis report

Static analysis result for SHA-256 33d84d61381d0ae4…

MALICIOUS

PDF

75.9 KB Created: 2020-11-09 19:07:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0664906fff0c91e2e271a027428a014d SHA-1: 1ab2d0fb8d2cc6f484d1c6dc683991cb9211f468 SHA-256: 33d84d61381d0ae48650b84eab8730f84ace36c640f993ad657d7f091fc47ea9
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics, including a critical alert for linking to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text suggesting it is a manual for 'Oontz xl', likely a lure. The presence of numerous embedded URLs, including one pointing to a malicious redirector, indicates an attempt to direct users to harmful content. The ML classifier and ClamAV detection further corroborate the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=oontz+xl+manual
    • https://konibexik.weebly.com/uploads/1/3/4/5/134515119/sosagotaw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/libowebujakux/neverwinter_testimony_of_the_brave.pdf
    • https://s3.amazonaws.com/nonipesikiri/pathfinder_shambling_mound.pdf
    • https://uploads.strikinglycdn.com/files/eea9c164-acb0-4c1f-b047-d90b1f7b4d41/xoludakenasitabape.pdf
    • https://uploads.strikinglycdn.com/files/5228acc8-e897-4c23-8f7e-4d020126dd8b/70848180964.pdf
    • https://s3.amazonaws.com/davawina/capitulo_baleia_vidas_secas.pdf
    • https://uploads.strikinglycdn.com/files/62ce0e3f-dbea-4bcf-90d6-f8c735cb726c/the_displaced_person_flannery_oconnor.pdf
    • https://uploads.strikinglycdn.com/files/5132428d-b270-4fff-bcd8-b9eaf824d06d/nenafuwoje.pdf
    • https://uploads.strikinglycdn.com/files/c4d7449a-1b0c-443f-a40b-c1f1a159cb63/12310119439.pdf
    • https://uploads.strikinglycdn.com/files/1c144919-a600-4141-9496-03f2f26047d4/23713550026.pdf
    • https://uploads.strikinglycdn.com/files/1155a549-39ee-44f8-917b-058e381b9c1b/melib.pdf
    • https://uploads.strikinglycdn.com/files/6694f857-ce1c-4aee-8765-e57245d35771/banirazobavaxusakizize.pdf
    • https://uploads.strikinglycdn.com/files/21b488e5-8db8-4823-b85f-bbc2d205cd4d/jidaso.pdf
    • https://s3.amazonaws.com/dobesogum/ludazaguf.pdf
    • https://s3.amazonaws.com/xanebavifamopez/mac_preview_form_font_size.pdf
    • https://uploads.strikinglycdn.com/files/f3602d32-a3dc-41db-95f6-3fc4103cc1b3/c_completo_e_total_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaf1.bin
46b72beca6a8135c383cc763687a8500e156748491e1de9493f301395d091537		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAF1 4700 bytes
font_01_sfnt_off0000fae4.bin
35d9ab0a7fe9a6a370ba2d565b6b609463f8815681cd3966835c5b3e62c93148		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE4 12312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.