Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ecf2198195e5776…

MALICIOUS

PDF

55.8 KB Created: 2020-11-09 10:57:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: e5cf171436a3307dc788a3bbe0341f1e SHA-1: e47569bcd64a35304a9d8032b23cb97b8f972ace SHA-256: 7ecf2198195e5776811616269fa73a8358672586c1e478cdd0c48da4ea16a74a
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by an ML classifier and contains a link to known malicious redirector infrastructure. The embedded URL, https://traffmen.ru/aws?keyword=1001+things+to+build+in+minecraft+pc, is the primary indicator of malicious intent, likely serving as a lure for further malicious activity. No scripts were extracted, but the presence of a malicious link strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?keyword=1001+things+to+build+in+minecraft+pc In PDF document text
    • https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/paxokufeselano-lemefakonid-fisorewoxetut-mufipuxisis.pdfIn PDF document text
    • https://rokumetusemep.weebly.com/uploads/1/3/4/3/134382705/kopovopugawazoka.pdfIn PDF document text
    • https://nikudedixipapun.weebly.com/uploads/1/3/4/6/134692686/mowibaluduve.pdfIn PDF document text
    • https://fewaxozane.weebly.com/uploads/1/3/4/3/134341296/telugumaf.pdfIn PDF document text
    • https://sukowaletudevux.weebly.com/uploads/1/3/0/8/130874669/6193387.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/42bdeaf4-ad44-4562-afce-30754eee9846/11946039772.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d2ebc69-c34e-41d9-b5f0-8f508d67e0b0/bethel_high_school_hampton_va_calendar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d048f0f-79e5-40ee-a9a6-f58daa442b3a/63323196764.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bf63a21-0f5e-4f5a-a7e5-820acb9825f5/31428955911.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0beddb2a-60bb-493e-be4c-19d39b6ce600/fowilaribogarego.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e83ed4ad-97f0-483b-8cf4-a1099ebec918/61866877309.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000076bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76BB 5692 bytes
SHA-256: d6f670919037ee37d92cdb8b2b44f58ece17848ba90ab4892d01915e844e4f74
font_01_sfnt_off000089d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x89D8 10576 bytes
SHA-256: 863d1fc56d89ad0e42c426244047f42d134373bbe1667e7f75ce481a4146f44b
font_02_sfnt_off0000ade9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xADE9 16332 bytes
SHA-256: 69d723212eb6dd1954cef9b4649bd4df6eb17a6f495b2db8137d34beed6776af
font_03_sfnt_off0000c386.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC386 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.