Malicious PDF — malware analysis report

Static analysis result for SHA-256 4275afd3e18a2c7f…

MALICIOUS

PDF

65.6 KB Created: 2020-11-11 21:49:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b47bcb1d4ebc22c995c150e76a074dff SHA-1: 0f27f06db8f3bafdbaaffef75af4bac1c70e181e SHA-256: 4275afd3e18a2c7f328631b8af16f90e6f6c80df2299742d3dda23a062171b5d
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external websites, including a known malicious redirector at 'https://cctraff.ru/strik?utm_term=igbunu+onosode+funeral+service'. The document body, though heavily obfuscated, appears to be related to a funeral service, suggesting a lure for phishing or malware delivery. The presence of many PDF links and the ML classifier output strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9876

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=igbunu+onosode+funeral+service
    • https://vixamimi.weebly.com/uploads/1/3/4/6/134684805/8001050.pdf
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/jasamejug-jenutuzudemeluf.pdf
    • https://cdn-cms.f-static.net/uploads/4404723/normal_5f925c8072b4d.pdf
    • https://somubafe.weebly.com/uploads/1/3/4/4/134444697/zunili.pdf
    • https://ramipataxeki.weebly.com/uploads/1/3/4/4/134483057/vakubod-xamivuwasoset-vefakotaz.pdf
    • https://cdn-cms.f-static.net/uploads/4369310/normal_5f8fb197a2b0c.pdf
    • https://lajoreruxox.weebly.com/uploads/1/3/4/5/134588124/596f48d.pdf
    • https://cdn-cms.f-static.net/uploads/4446489/normal_5fa40de43fcab.pdf
    • https://kanamatadu.weebly.com/uploads/1/3/4/3/134366206/korejugizapa.pdf
    • https://lubukapilibuvi.weebly.com/uploads/1/3/4/0/134095968/1d6fad6d3.pdf
    • https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/filosom-lusiwikafese-jerupuxorukoti-novubolifunuw.pdf
    • https://cdn-cms.f-static.net/uploads/4367301/normal_5f908b093f6e3.pdf
    • https://cdn-cms.f-static.net/uploads/4405642/normal_5fa1cf5b1d466.pdf
    • https://cdn-cms.f-static.net/uploads/4371269/normal_5f8abb027ddf3.pdf
    • https://cdn-cms.f-static.net/uploads/4369508/normal_5fa44d749e876.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pegek/bizaardvark_theme_lyrics.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0a0.bin
ffec5f628c8560f2f138903bd698654e483ce971e3719ba4b3fea178239b5a86		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0A0 5328 bytes
font_01_sfnt_off0000e2dc.bin
f8557b203cefebda2e61ad86e6441e4b15544adecbd56fff0d72184ea6d6acfa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2DC 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.