Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2a740236c6b2e9c…

MALICIOUS

PDF

48.8 KB Created: 2020-10-30 23:27:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: af2fd62ea727f60919cba88e3feaa2f1 SHA-1: cb9d58b46d71e781e114a7980b3b36e10f6907e7 SHA-256: a2a740236c6b2e9c85c8c7a109008bb415121e36f7166e828b5b8d63a745f373
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to a known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The embedded URL is the primary indicator of malicious intent, likely leading to a phishing or malware download site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=what+enables+a+computer+to+connect+to+the+internet In PDF document text
    • https://cdn-cms.f-static.net/uploads/4382408/normal_5f8dcb19d93fb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/bubeto/bardonecchia_piste_map.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/children_s_cursive_writing_practice_sheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36ff3daf-bd51-43d8-b9df-ad89f9047cbf/86483551470.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9dabf42-c02b-47d0-aaba-5b4cd9904e94/feral_druid_leveling_guide_tbc.pdfIn PDF document text
    • https://s3.amazonaws.com/xojafemori/vufunuziro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/591a98db-9ecc-4c7b-be7d-7ea7996e1eb7/the_musicians_guide_to_theory_and_analysis_workbook.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/4th_of_july_quotes_for_instagram_funny.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/727c1808-f49e-405a-b6f9-047caec2bf06/dufen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84cef256-8869-4c26-9d5d-d2974b4cc361/nursing_diagnosis_for_respiratory_depression.pdfIn PDF document text
    • https://s3.amazonaws.com/jenagubadopi/70037240284.pdfIn PDF document text
    • https://s3.amazonaws.com/gotijejaj/btc_blockchain_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30273aab-e734-4c80-b5b3-44927f2f77f7/33417227548.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0f606ea-33b5-4627-9cc8-33b99781f61e/xemotobozavafopafe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000735e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x735E 5208 bytes
SHA-256: bbcae7ec9e80999444e3a615c5d4352fe744942f120cf63d797c1016e7cec4b2
font_01_sfnt_off000084de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84DE 10196 bytes
SHA-256: 84b95ce89a892f33e20d2bc9ac8be99df4383d961e55707a346d84c79d048f8d
font_02_sfnt_off0000a7cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA7CD 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.