Malicious PDF — malware analysis report

Static analysis result for SHA-256 614383e75c7d07da…

MALICIOUS

PDF

152.1 KB Created: 2020-10-28 03:51:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 0dd63e05a82cfc0230d3e9550f161a50 SHA-1: 1926e773851f885a95eb8713d0b85e1f8c01be0f SHA-256: 614383e75c7d07da482905fcecd63b407e35de04e1aeefc22eb57d5b9127fc43
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://cctraff.ru/strik?keyword=pathfinder+air+kineticist+build'. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the embedded URL is the primary indicator of malicious intent, likely serving as a lure for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=pathfinder+air+kineticist+build In PDF document text
    • https://vozuzuxe.weebly.com/uploads/1/3/4/3/134314749/pijen.pdfIn PDF document text
    • https://pagofere.weebly.com/uploads/1/3/1/3/131398194/5724859.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381546/normal_5f94302d5a3ca.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393197/normal_5f90d625bd878.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371543/normal_5f935274c772c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387715/normal_5f94911fab1a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367927/normal_5f8fee0aedfea.pdfIn PDF document text
    • https://wunimebi.weebly.com/uploads/1/3/4/3/134361225/200316545c8.pdfIn PDF document text
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/jinitorip-bolag.pdfIn PDF document text
    • https://rowofijiguni.weebly.com/uploads/1/3/4/4/134479741/malidurusowifip.pdfIn PDF document text
    • https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/naniro.pdfIn PDF document text
    • https://talapilodegopez.weebly.com/uploads/1/3/0/9/130969507/3759358.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/2638/2500/files/42440624551.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/6543/3000/files/dna_extraction_book.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/0185/6668/files/webufi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5670/1346/files/lurep.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0505/5479/8263/files/rinnai_rl94i_owners_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/6332/6358/files/5734354410.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/0343/6446/files/welbilt_bread_machine_models.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2868736b-0bc0-4707-af45-6ce6b19e1395/505659271.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e935fb35-8d12-4e17-8391-e7177048dc25/95182651487.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a023846-2add-4b5f-b77a-4f8491e8e6d6/84846011419.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db10c447-8ae1-433e-9366-12d81167927a/ropiwukezevidokariwuz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002198e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2198E 5316 bytes
SHA-256: 375b7649e62dfb4a78596c06019969091c17f38514c3760ee195b1ddf6cb1d4b
font_01_sfnt_off00022b86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22B86 11416 bytes
SHA-256: 45c41cf936563932aeb23515b7c2566d691513ade82c5ee6b731527f3067af9f

Open this report in the interactive analyzer, or submit your own file for analysis.