Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c6812314eba011d…

MALICIOUS

PDF

71.4 KB Created: 2021-01-24 19:31:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: ac596ad8aa13476efc3c75f378347621 SHA-1: 3895fb3f5d8938c4b4766de8856f897ed24ab316 SHA-256: 9c6812314eba011d62a6d7b3de93aa6ea8183f9c4a0ab840c0cf67fb6f0ba802
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is designed to lead users to potentially harmful content. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL is likely part of a phishing or social engineering scheme to trick users into downloading malware or visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/wb?keyword=stickman%20wizard%20mod%20apk In PDF document text
    • http://nizozipup.22web.org/9th_class_result_2019_bise_sukkur.pdfIn PDF document text
    • https://cdn.sqhk.co/guledijuxi/jjziaF4/20621582776.pdfIn PDF document text
    • https://cdn.sqhk.co/vabadoma/hibgigc/what_is_the_golden_man_booker_prize.pdfIn PDF document text
    • https://cdn.sqhk.co/sileluzorupo/gjcCjfa/jezujotewasibidunax.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384325/normal_5fc62ecceae59.pdfIn PDF document text
    • https://cdn.sqhk.co/wifukatar/7ieflhe/turbofly_hd_game_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388613/normal_5fe6f8c4cdf91.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464541/normal_5fe99a57ed3aa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444369/normal_5fcd43a88666b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387566/normal_6004f8245b8b3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457582/normal_5fff4150d7593.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474722/normal_5fc7d0b187311.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384308/normal_5fe503bc623bd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://fopagozijudiri.epizy.com/18562494882.pdfIn PDF document text
    • http://fuvezijejek.epizy.com/handover_report_form.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bd46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD46 5316 bytes
SHA-256: fa66e6ac294cd370080c568e4ac9716e10918a9f9d4025629fa19b9e98465380
font_01_sfnt_off0000cf5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF5E 3740 bytes
SHA-256: 49a7b6a6022ad0750f3ce9b713f85c7cd2f2c955e32e46ddff28ce33b45939fd
font_02_sfnt_off0000dad8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAD8 13260 bytes
SHA-256: 7dddb0c81da6248a8fa09cde0952fe50ebe33772b4a583b6de18aff756689046
font_03_sfnt_off0001051b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1051B 2724 bytes
SHA-256: d7c962a3cd650325ae2bbc48c72968730e2ce042a0515202de8162792db2df8d

Open this report in the interactive analyzer, or submit your own file for analysis.