Malicious PDF — malware analysis report

Static analysis result for SHA-256 56efcb253dd8317e…

MALICIOUS

PDF

67.5 KB Created: 2020-12-21 20:57:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 521bf867d63c06dc385ca7f6945b812d SHA-1: 88fc09fe4faf014cc50716e49eafd52a35d981d2 SHA-256: 56efcb253dd8317e2af4018977d0ee59215cc09b8d0f9c02dd940a80ca21cc20
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high probability of malicious intent. It contains a link to a known malicious redirector, https://cctraff.ru/strik?utm_term=little+pony+unicorn+images, which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to 'little pony unicorn images', which is a common tactic to entice users to click malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=little+pony+unicorn+images In PDF document text
    • https://cdn-cms.f-static.net/uploads/4382405/normal_5fa88677939d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410462/normal_5fd7dc0bd437b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386079/normal_5f9a88ed959ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417207/normal_5f9b9bcfedbf7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413475/normal_5f9bc3faf1cf9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383444/normal_5f8d6d553fd47.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421612/normal_5f97a0069ced6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366655/normal_5f8d4b9f892fa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc6ad9ba5bc066edfcdf9d6/t/5fcc23d71e1a4d7de11a9343/1607214040158/4087089386.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b8aca45-53d5-4e1a-9f6e-28d606284dd5/zovox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/857af651-363b-4f45-83c5-ccba2d0ce5cf/36548174825.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e29e9c6-bfb5-410f-98e0-79262dfb19e3/weathering_gizmo_activity_b_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d14eda3d-8026-4440-be8d-d77b9945d889/napuxok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ee219a3-97ef-4d3f-8157-29cf38a12736/sad_love_letters_for_girlfriend.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5dc0a0a2757459b04ecdf/t/5fc9a3de2f5dbb44b776fd6c/1607050206943/chicken_invaders_3_christmas_edition_free_download_full.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9acd85c3-09df-4107-9793-6f37bef4511e/26057427620.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7538c254-badd-47aa-b6ef-8ee325c2b525/writing_equations_of_parallel_lines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC1D 5296 bytes
SHA-256: a19055291e57223e0eadfa99b01166e414d0a17b62d2bdd8d48746d14d541d9d
font_01_sfnt_off0000de17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE17 10352 bytes
SHA-256: 241bf32f30703297136d280ce2a31a5bbb41061822e65d01bdb2449ee228049f

Open this report in the interactive analyzer, or submit your own file for analysis.