Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c88973192b4bb9f…

MALICIOUS

PDF

78.0 KB Created: 2021-01-08 15:12:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 73586b0a9af4b6a2027446da9a82e95b SHA-1: 672eae0992c73ae3477d5213e7bf0992cd9ef565 SHA-256: 6c88973192b4bb9f3aac7c35a8afc5c9ee480748061eb70641f6a710e221df97
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to `https://cctraff.ru/aws?utm_term=simone+de+beauvoir+pdf+los+mandarines`. This URL is likely used to redirect the user to a phishing page or to download a second-stage payload. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of malicious URLs indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?utm_term=simone+de+beauvoir+pdf+los+mandarines In PDF document text
    • https://cdn.sqhk.co/doxowite/gghg2ge/zakojetusapijorixi.pdfIn PDF document text
    • https://cdn.sqhk.co/fopujetoros/EbhgjdJ/vapuxepuzajuxux.pdfIn PDF document text
    • https://cdn.sqhk.co/ponesigis/uQYhbic/preschool_all_in_one_mod_apk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446289/normal_5fa10f3d853c6.pdfIn PDF document text
    • https://cdn.sqhk.co/libegavezu/hhhawhd/best_background_video_recorder_for_iphone.pdfIn PDF document text
    • https://siminanora.weebly.com/uploads/1/3/4/6/134611077/jepoduzikenikama.pdfIn PDF document text
    • https://cdn.sqhk.co/xedufoga/5UVghji/nail_and_spa_in_the_mall.pdfIn PDF document text
    • https://cdn.sqhk.co/jaguwubax/zOjgHjd/vibijozofelimovixif.pdfIn PDF document text
    • https://sakotitalivuvu.weebly.com/uploads/1/3/4/8/134887700/wamisutu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449615/normal_5fdebaf2ebbaa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/mavixu/microsoft_windows_7_bootable_iso.pdfIn PDF document text
    • https://s3.amazonaws.com/sobaketemu/10604854912.pdfIn PDF document text
    • https://s3.amazonaws.com/lofese/physical_and_chemical_properties_worksheet_middle_school.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/70738893660.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB1F 5292 bytes
SHA-256: 593fb1282c866b643a229f7a5b8c919a468835da538136cca2d41ee264a1f705
font_01_sfnt_off0000ecf1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECF1 15500 bytes
SHA-256: 28c54715468e586690b1b2394697564333858ef3035f841311e05b7044d91c0e
font_02_sfnt_off00011ad2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AD2 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.