Malicious PDF — malware analysis report

Static analysis result for SHA-256 66954eae28058416…

MALICIOUS

PDF

58.4 KB Created: 2020-10-09 15:59:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 64a0838895c5c7a1643d05259f2a506b SHA-1: 84c379cfc0fd21afa09fe6732036a673146522b7 SHA-256: 66954eae280584168410efafb37e03c498de93a3e97c02d634abb0b6ea989800
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating a malicious redirector link to 'https://cctraff.ru/strik?keyword=masked+forces+crazy+mode+jul+games'. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of a malicious URL embedded within the document body suggests an attempt to lure the user to a compromised site, likely for phishing or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=masked+forces+crazy+mode+jul+games In PDF document text
    • http://zexuwa.funthoughtsonlife.com/uploads/1/3/0/9/130969940/puxurozezepi-jobip.pdfIn PDF document text
    • http://jipopudi.expressivelanguagecenter.com/uploads/1/3/1/8/131859261/zakone.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/2509/5062/files/11179203597.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/7513/2824/files/21013153715.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/9946/6142/files/dovidokebinasalizapig.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/0050/6785/files/2048_star_wars_sith.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/9548/5352/files/360_leader_book_review.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/4190/7100/files/xamevifaxoluwukuvorudofaj.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0478/7853/7382/files/guideline_document_in_judicial_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97f5eac5-23fc-44aa-90eb-1785213ed903/9573492128.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1205a763-4b4b-4a53-a8f6-4f6db02e7984/44150090148.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d08fbd53-952f-4163-8494-cdcdbdf58e2c/28080705974.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005dcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5DCD 22720 bytes
SHA-256: 4f18e6a20d0f3cd8ee990ff8fee148fc0e573f82ddc865fb409989c1568c7668
font_01_sfnt_off0000a575.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA575 5636 bytes
SHA-256: 4e7c731714bfaccd8b696ab329ecc11a0ba1aebd83025e13eae53aa135709c13
font_02_sfnt_off0000b8ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB8BA 10616 bytes
SHA-256: a843e242d4d143ad33d2526250ad83978ff7420363f3a32dc65e36ebe0cc188e

Open this report in the interactive analyzer, or submit your own file for analysis.