Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dca41d323eb9723…

MALICIOUS

PDF

41.4 KB Created: 2020-10-30 22:09:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: c855945650e56f8052362dabcc76a4e1 SHA-1: d8a04b797428e4bd7f40b029169f521322c086ba SHA-256: 6dca41d323eb9723ef51c2c1469150495bf7a374d9c7fa6cdbec52c4c7e7e2d6
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=mantak+chia+pdf+free In PDF document text
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/9232432.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377679/normal_5f8d9652272af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379477/normal_5f8b4cc112c92.pdfIn PDF document text
    • https://mevamakokuvafas.weebly.com/uploads/1/3/4/0/134040887/kupaxubemumof.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/13875f27-6a00-4ab2-9c11-bf292cfb7c91/duvipelilub.pdfIn PDF document text
    • https://s3.amazonaws.com/wusone/batijurumi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca377ba1-70b6-49de-b723-c0b39d7b0bbc/fifiwipadasifawaselozaw.pdfIn PDF document text
    • https://s3.amazonaws.com/xezonijida/pance_prep_pearls.pdfIn PDF document text
    • https://s3.amazonaws.com/rufonali/whirlpool_wher25_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/gumegulaxi/61708219221.pdfIn PDF document text
    • https://s3.amazonaws.com/susopuzupure/bupobero.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b0db3a8-86bb-491c-84b8-62415955c202/korulib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16774526-e2c4-47af-acf7-2af278e98c30/33430743140.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/054a2f0b-d66b-4950-b5b5-414850d1068a/94104110856.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00007b1e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7B1E 18528 bytes
SHA-256: a2e28762f60d12a55dd8280064312bb58e38e5ad7ee0a5dc9cf4d1045d787cce
font_00_sfnt_off000047b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x47B4 5104 bytes
SHA-256: a0232047e113ea46fe141f94bd32eb43b7ac0c80fb6de59e10a98172ebf27858
font_01_sfnt_off0000591b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x591B 9944 bytes
SHA-256: 681e5637a4ec5b526ab1b08e1ae177a673c9f5655593f21032d9058274a03e48

Open this report in the interactive analyzer, or submit your own file for analysis.