Malicious PDF — malware analysis report

Static analysis result for SHA-256 8dd5c0d391c2fa14…

MALICIOUS

PDF

40.2 KB Created: 2020-11-04 12:20:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: beefa59dd9c937312449c3c93ae6d8b3 SHA-1: dad342d3a128257a16077c6bbfb4488ad4ef3b2b SHA-256: 8dd5c0d391c2fa14df249ff53334e6267ef41e9fc88b76970b0a76b7b70f5593
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=manual+for+brother+xl+3750+sewing+machine In PDF document text
    • https://cdn-cms.f-static.net/uploads/4426060/normal_5fa1e83850b0e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380223/normal_5f8b271a9944a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384159/normal_5f8be9d3145fe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392220/normal_5fa271dc8a59e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368235/normal_5f9d4e54832f1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384301/normal_5f9815b3b0c53.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366987/normal_5f937a4b91c20.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb840c27-c2b2-4f6a-bdec-c19c08125b0e/21971590326.pdfIn PDF document text
    • https://s3.amazonaws.com/ronenitevodo/vepitokuja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b38303f4-95e4-4647-899b-da1bd19d32bd/90834578114.pdfIn PDF document text
    • https://s3.amazonaws.com/kagedatabujo/central_jr_high_bedford_tx.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005d43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D43 6112 bytes
SHA-256: 59dc552392f77391161eb433ef2834adf67fc31bb37458cfdbcba60631f60b80
font_01_sfnt_off00007216.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7216 10116 bytes
SHA-256: e6823cec894fb62ee968e66c2e996d158ba0a1124bda07678ff857d1cce1a6cc

Open this report in the interactive analyzer, or submit your own file for analysis.