Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c491484eece6e67…

MALICIOUS

PDF

65.6 KB Created: 2020-12-27 18:46:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 64b847b8d699d5d0ef23bed13583792f SHA-1: 2b57a561ef67b3665fac0a99f2d9bac6ac425162 SHA-256: 3c491484eece6e67041fa7af808b07d6357a5e91a1205fc9776e0ee47f7564b6
212 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, appears to be a lure related to an idiom definition, likely intended to trick users into clicking the malicious link. The presence of a PDF link farm heuristic further supports the malicious intent of directing users to external, potentially harmful, sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7486

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=what+does+the+idiom+out+of+the+loop In PDF document text
    • https://cdn-cms.f-static.net/uploads/4408330/normal_5fb4bc88dab78.pdfIn PDF document text
    • https://tuvitewolejuxow.weebly.com/uploads/1/3/4/6/134615754/7263201.pdfIn PDF document text
    • https://xaxafojub.weebly.com/uploads/1/3/0/7/130738676/276400.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/87a6ce6d-6096-43b1-a0cb-f8e6dc3c678e/dotelunazunof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11189dc4-5fed-420c-957b-3ad6c0c90fb5/17420782987.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d89edc08-7a75-4636-9bf8-99c165192078/62341640790.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a8f6920-66c7-4d95-913d-64b34d3e0b97/80889135090.pdfIn PDF document text
    • https://s3.amazonaws.com/rogugagatuf/uf_sona_systems.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/acf081f6-a549-468d-bb31-94a686f92830/virozixewulomugijawoxezu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/369910b9-10c5-4df3-929a-497b802bc847/79450127854.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d35b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD35B 5200 bytes
SHA-256: 6e9a57a7b5643866c0e1f6f401621ad0ac3fe6e99004e8d56ca3ad21cc83442d
font_01_sfnt_off0000e4f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4F6 10808 bytes
SHA-256: 0558564219806d6fbb8101579b3f0ed6ac60c6306d00b26266a493d22ae55bb1

Open this report in the interactive analyzer, or submit your own file for analysis.