Malicious PDF — malware analysis report

Static analysis result for SHA-256 4eaa33210d4be7cc…

MALICIOUS

PDF

41.0 KB Created: 2020-10-07 12:57:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: bb9702d282f33742946266c8c5f3859f SHA-1: e808fbae5aea08f8aff7beaf471dfbdabed29a90 SHA-256: 4eaa33210d4be7cc1b2ddfef6226ace3ed1f35709a0e9aa171aa7316c09a88c4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs that point to a known malicious redirector, disguised with keywords like 'powerpoint sabbath school lesson'. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' confirms this behavior. While no scripts were directly extracted, the PDF structure and embedded links suggest an attempt to redirect the user to malicious infrastructure, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=powerpoint+sabbath+school+lesson In PDF document text
    • https://site-1040561.mozfiles.com/files/1040561/54710971057.pdfIn PDF document text
    • https://site-1037262.mozfiles.com/files/1037262/91744181210.pdfIn PDF document text
    • https://site-1036812.mozfiles.com/files/1036812/50221739185.pdfIn PDF document text
    • http://files.royalbridal.shop/uploads/1/3/1/3/131381781/1665706.pdfIn PDF document text
    • http://files.goodtimepainting.com/uploads/1/3/0/7/130775845/e094429.pdfIn PDF document text
    • http://luxata.tcnazchurch.com/uploads/1/3/0/7/130775126/zodikedotik.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/832a4325-0d8b-4fc9-877a-229075713656/kutomaxugadurirofokidezub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c016871-2e08-4ee8-93a3-d495e648c4ba/16463638003.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27080159-97d6-4b66-8857-f725b488fbbd/10987088622.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b19913ed-6861-4a8e-b975-3b05def6b2af/movona.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40688718-b14c-4736-9bfb-c7d20eb74d21/58611316024.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b442b26-6e6f-4348-ac0d-5ec5844eadc8/6651810208.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000627e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x627E 5252 bytes
SHA-256: 5142a8c82ecf191f0082af5e6806432bfad7c1e239f7e03601cd5d7e50ab8c68
font_01_sfnt_off00007462.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7462 10128 bytes
SHA-256: 4f0323f6d2f0544cafde9225ee9434f15cdd4dd8cf3fb679b14927e70cfd1592

Open this report in the interactive analyzer, or submit your own file for analysis.