Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c67dff65abfa83e…

MALICIOUS

PDF

42.2 KB Created: 2020-10-23 15:32:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 61dc9427635e5d539f69f7ed0dafa9c7 SHA-1: 32416518b8541213ca34bd3983d7cd0420fd56bb SHA-256: 4c67dff65abfa83e7f0d6b6fd3699b2a2260fffe999e8b98823b680adfee6fdc
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to a link farm designed to redirect users to malicious infrastructure. The primary malicious URL identified is cctraff.ru, which is flagged as a known malicious redirector. The document body, though heavily obfuscated, contains this malicious URL, suggesting an attempt to disguise its true nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=hz+muhammed+in+g%25C3%25BCvenilirli%25C4%259Fi+ile+ilgili+%25C3%25B6rnekler In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365567/normal_5f8fe767ab545.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368732/normal_5f8ac6af4cfff.pdfIn PDF document text
    • https://soremezu.weebly.com/uploads/1/3/1/0/131070226/e96725878976b5.pdfIn PDF document text
    • https://lajojixuvoporor.weebly.com/uploads/1/3/0/7/130738555/xusadedef-gilowulojasedu-pajewika.pdfIn PDF document text
    • https://dadopulemuxujew.weebly.com/uploads/1/3/4/3/134375911/nojaja_dilogijurumowid_janaxo.pdfIn PDF document text
    • https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/1eac5f5f7.pdfIn PDF document text
    • https://lorovojiwu.weebly.com/uploads/1/3/4/3/134318747/pukaj_dofalokesekit.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/41168502-6690-4947-8977-2f06ca5b42ec/rusubiloje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2df1be6c-670f-4471-8318-c7081b6b4f30/craftsman_c3_19.2_volt_lithium_ion_b.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0c26537-243f-4964-a898-078c56e39024/vituxajadifono.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c50c079-0029-4d3d-a081-6b16200ddf10/jubilakuvoxutuzu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc3de9a6-579c-42b9-8285-770a964a2c00/73708549788.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8074da44-875c-4e39-ade6-10804f0e71b4/49471948016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c22ad263-2154-40f9-824b-a73cd82e1eaa/guwikusegoxomalibozerav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e126027-96db-4a98-abee-8e6a7bb80a96/how_to_ddos_a_gmod_server.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a993f4af-cf81-4904-b5ba-266791c36cb7/86404572662.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70e6a253-eb63-4b88-8ccc-f7958d3c9db7/61762038479.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dce8b897-e6b9-4821-88cb-1ca06c899753/44718410939.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57ddc18d-9ecd-4ad7-b791-218e001bedc0/95865174490.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000625a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x625A 5684 bytes
SHA-256: 4aa1cfa06e74721b6688f5cfbdf12eb8ab4113a90b027870d79e66acf1fe77de
font_01_sfnt_off0000749a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x749A 11812 bytes
SHA-256: b9764932474fd51e3f320efec331c9d2605940e0f79cc58e01a3598b57a9a74d

Open this report in the interactive analyzer, or submit your own file for analysis.