Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d2bd8e4ef29ee82…

MALICIOUS

PDF

37.6 KB Created: 2020-11-04 17:57:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a11634d4b7e6b47d4a702ed6521bfaf4 SHA-1: 922d08f5fea0eaeeffdbdf1dd0e99929c6aedd1c SHA-256: 4d2bd8e4ef29ee8250c5dc8123ce96eb91d19b29f376cab3028d406b887884cb
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that redirect to a known malicious URL, indicating an attempt to lure the user to a malicious site. The document body, though partially corrupted, includes the target URL, suggesting a phishing or malware distribution attempt. No scripts were extracted, but the presence of malicious redirector links is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=angeletta+skin+cream+price
    • https://cdn-cms.f-static.net/uploads/4389582/normal_5f9040772a227.pdf
    • https://nitowapesapu.weebly.com/uploads/1/3/4/4/134442046/jibulidip_lasone_lukojawefever_lajidofuxepaka.pdf
    • https://cdn-cms.f-static.net/uploads/4392195/normal_5f91db70bb09c.pdf
    • https://cdn-cms.f-static.net/uploads/4371808/normal_5f9048ce3eaa3.pdf
    • https://cdn-cms.f-static.net/uploads/4365998/normal_5f86ff819d80e.pdf
    • https://cdn-cms.f-static.net/uploads/4384821/normal_5f913a9b79428.pdf
    • https://cdn-cms.f-static.net/uploads/4366000/normal_5f8742531a26a.pdf
    • https://cdn-cms.f-static.net/uploads/4365576/normal_5f871790f353c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/396b2c86-b719-4cd9-a5a3-b5083aac21e0/vuvutagexeruwato.pdf
    • https://uploads.strikinglycdn.com/files/c08b058b-3302-4f11-825d-b9701859a21d/gitanenajiwunosi.pdf
    • https://uploads.strikinglycdn.com/files/c6cac616-60be-49db-9831-fb2bdf430caa/kogabixakavutobofisusozak.pdf
    • https://uploads.strikinglycdn.com/files/7cd74588-aeb3-4aa1-b848-07c0061f8cd6/vamoworur.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065f3.bin
99bfd81045ffe97c8f68849e3a5b79ec5172f3228340e23999fb2aef8d19562b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65F3 5304 bytes
font_01_sfnt_off000077f1.bin
63b3f6d324e191cbdcec6932234389e5913403c10f3b83bf7212115c77f2aff2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77F1 10888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.