Malicious PDF — malware analysis report

Static analysis result for SHA-256 83c77d142b573387…

MALICIOUS

PDF

32.0 KB Created: 2020-11-02 22:23:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 69d55e113bc8cac135efef8f513568c5 SHA-1: cc0d488d51477e45508c58d40f8fea3a3b593eb9 SHA-256: 83c77d142b573387f95f3d4c79f7f072a16b4bd33d68fd50beb4a52c76775f82
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to known malicious redirector infrastructure at https://cctraff.ru/aws?keyword=7+continents+and+5+oceans+map+blank. The ML classifier also flagged this PDF with high confidence. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to lure the user to a malicious site, likely for phishing or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=7+continents+and+5+oceans+map+blank
    • https://cdn-cms.f-static.net/uploads/4390663/normal_5f96ecd65c6b5.pdf
    • https://cdn-cms.f-static.net/uploads/4376105/normal_5f899e022ba51.pdf
    • https://cdn-cms.f-static.net/uploads/4365619/normal_5f90dcf8d1aae.pdf
    • https://cdn-cms.f-static.net/uploads/4366341/normal_5f88425c71000.pdf
    • https://cdn-cms.f-static.net/uploads/4383566/normal_5f9976ab0b0b5.pdf
    • https://purowuma.weebly.com/uploads/1/3/4/4/134472698/fab78e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0429/6146/9599/files/tinujob.pdf
    • https://cdn.shopify.com/s/files/1/0507/9593/7989/files/xamopedudelal.pdf
    • https://s3.amazonaws.com/vifusupegiza/verbs_that_start_with_ha.pdf
    • https://uploads.strikinglycdn.com/files/8ab5ccbf-9f65-473b-afdf-0c7810793875/jiniwojikoraxu.pdf
    • https://cdn.shopify.com/s/files/1/0504/6845/4581/files/fantasy_football_sleepers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004201.bin
2b5bcf1648bed247a1c7a2c1244ab4cb25de722190a89e4a758464001ba801ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4201 5436 bytes
font_01_sfnt_off00005470.bin
87d033ce6269176f9f9881d6a8ced1d8f724695618140a7474ceb3e01a804341		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5470 9068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.