Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f3f7a8a5123b55c…

MALICIOUS

PDF

68.0 KB Created: 2020-11-03 05:53:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 566c53d1f471a6a472f172a39a8ca9d2 SHA-1: 2a0e9801cf6bb03932a4bf22b89ecd3590a86235 SHA-256: 6f3f7a8a5123b55c895f441ab50373b7c6c74104bd929fa8ec255c5d1fddd56c
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=sports+heads+basketball+unblocked+zaya In PDF document text
    • https://topagolidokade.weebly.com/uploads/1/3/4/5/134502990/mabavuzerifadexotasa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366655/normal_5f8db5dadd309.pdfIn PDF document text
    • https://meboguvogo.weebly.com/uploads/1/3/1/4/131437667/gadewumeja_gitowakirefo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375514/normal_5f8ca58bdff6e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446931/normal_5fa079352690e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.indictrans.orgIn PDF document text
    • https://cdn.shopify.com/s/files/1/0441/2047/3752/files/daror.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/723e2c8e-d97e-4053-8449-0d04666172c0/kazinomukel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23bf24dd-1a7d-42fd-a35e-12a957e6ec0e/ekahau_site_survey_-_heatmapper_full_cracked.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/5598/8387/files/tabla_de_frecuencia_definicion.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/2348/0987/files/cs_timer_apk_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/7257/8244/files/british_heart_foundation_health_and_safety_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/0302/5840/files/26521561798.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0000ce58.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCE58 27928 bytes
SHA-256: de845bc09b24c495044ddaa5d200074a36b01c180accc3e33500578e5ffac2bd
font_00_sfnt_off00007dc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7DC2 5620 bytes
SHA-256: 6c63d59bd9ce513a915cd86e973b52e67224e3eb8840c3a153135d9fd0271db4
font_01_sfnt_off000090dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x90DC 8476 bytes
SHA-256: 5799272aa9f887c747fe1f00b5eef38c75668568798b782712ad07111d7d5e35
font_02_sfnt_off0000ac66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAC66 9952 bytes
SHA-256: 1cccdd064bcceebae0d2d30dd410251d39d6eb4b7d2627cfd674c0a4a52b9794

Open this report in the interactive analyzer, or submit your own file for analysis.