Malicious PDF — malware analysis report

Static analysis result for SHA-256 39451ae5d2ba9c51…

MALICIOUS

PDF

39.7 KB Created: 2020-10-28 21:10:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 336bbf193afc2c439674a36a07e9ad64 SHA-1: d54e5273605ecf2dc2c49bb2c67fb4804719674d SHA-256: 39451ae5d2ba9c51bb6258d9a85c5aea78c6af6e4e996875a293e93f37c3f743
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://cctraff.ru/strik?keyword=find+the+exact+values+of+the+six+trigonometric+functions+worksheet', is the primary indicator of malicious intent. While no scripts were explicitly extracted, the nature of the PDF and the malicious link suggest it's designed to lure users to a compromised site, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=find+the+exact+values+of+the+six+trigonometric+functions+worksheet
    • https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/fupipej-xekotumujupalu-mawejozujuk-digad.pdf
    • https://cdn-cms.f-static.net/uploads/4377391/normal_5f8ee4bc977b4.pdf
    • https://riragojefo.weebly.com/uploads/1/3/1/8/131857115/2499676.pdf
    • https://cdn-cms.f-static.net/uploads/4366382/normal_5f888f512ba39.pdf
    • https://cdn-cms.f-static.net/uploads/4413473/normal_5f96dc3f44c7d.pdf
    • https://fuparududewon.weebly.com/uploads/1/3/1/8/131856041/renixi_paxudejumag_xisexunuvero.pdf
    • https://cdn-cms.f-static.net/uploads/4375909/normal_5f8a0cecc9f74.pdf
    • https://cdn-cms.f-static.net/uploads/4375358/normal_5f97507c81808.pdf
    • https://cdn-cms.f-static.net/uploads/4370074/normal_5f956da38bd1b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/felasorarabipis/causes_of_biafra_war.pdf
    • https://uploads.strikinglycdn.com/files/f2358931-9478-46e7-b5f7-d71662edcd4f/benjamin_marauder_manual.pdf
    • https://s3.amazonaws.com/besafefaf/darogororukiwi.pdf
    • https://cdn.shopify.com/s/files/1/0500/3005/1499/files/cracked_spotify_android_no_root.pdf
    • https://uploads.strikinglycdn.com/files/4766b727-4edc-4cfc-a961-4575bcee0c11/battletech_record_sheets_succession_wars.pdf
    • https://cdn.shopify.com/s/files/1/0482/8269/7889/files/somowazekedukenerexuj.pdf
    • https://s3.amazonaws.com/jarawaxanivu/jotixovomeganoratemi.pdf
    • https://uploads.strikinglycdn.com/files/1164eeb0-b7fa-4749-aecb-39e68d914f13/33242674696.pdf
    • https://s3.amazonaws.com/widuxade/7549028869.pdf
    • https://cdn.shopify.com/s/files/1/0437/6199/1841/files/logemifufabelavax.pdf
    • https://cdn.shopify.com/s/files/1/0429/7100/5082/files/truvativ_x_guide_2x10.pdf
    • https://s3.amazonaws.com/mijedusovineti/alimentos_carcinogenos.pdf
    • https://uploads.strikinglycdn.com/files/d33e673f-dd52-4a60-8e7d-f10bcc378ee5/19942834420.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a62.bin
a6f2e9520dbee3fcd97be8543e99e3bec702f2ba4e69a932dfda4418948d649b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A62 5676 bytes
font_01_sfnt_off00006da8.bin
5d1321272c87133b0680b22464d04033a3867ce6b2e8b97ea21766193e2c0f38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DA8 10256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.