Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4400a4f18b6610f…

MALICIOUS

PDF

77.6 KB Created: 2020-12-13 23:11:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58874384e8491756fe80a3b93e4e8126 SHA-1: 17445fe07c23583da53f39f2c914ce1dc0eccc24 SHA-256: a4400a4f18b6610f638165d87018f56f5a9cfece1f94067d99e5e29d6e883a62
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to known malicious infrastructure, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also strongly flagged this PDF as malicious. The embedded URL is used as a lure, likely to download a second-stage payload or redirect to a phishing site, aligning with spearphishing attachment tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=102+dalmatians+full+movie+in+tamil+free+download
    • https://cdn-cms.f-static.net/uploads/4490949/normal_5fb5e9a73366a.pdf
    • https://cdn-cms.f-static.net/uploads/4404520/normal_5fbd8ffcb3456.pdf
    • https://cdn-cms.f-static.net/uploads/4371791/normal_5fb561be31aeb.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/viromibukoleliw/antique_olive_bold_condensed_font_free.pdf
    • https://static1.squarespace.com/static/5fbfb2312cf09257bd651d14/t/5fcbd09ea0b42e3566b251fa/1607192737970/53746951267.pdf
    • https://uploads.strikinglycdn.com/files/20e00d86-9816-42bb-af6f-3b65fd28f4b3/zhuangzi_book_quotes.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/keeping_faith_season_2_episode_guide.pdf
    • https://s3.amazonaws.com/kodipopujufipig/sodadefuguwudanulala.pdf
    • https://uploads.strikinglycdn.com/files/b5d65951-63a0-4626-afd4-a504b989cf1e/96288574572.pdf
    • https://s3.amazonaws.com/nisoxow/business_process_outsourcing_industry_report.pdf
    • https://uploads.strikinglycdn.com/files/a1a022be-7a4b-47e9-bbc7-4e90613319ab/44045964195.pdf
    • https://static1.squarespace.com/static/5fc15d59403f5353fd98fe44/t/5fcc81f105ddc9599d1af020/1607238133929/cruise_critic_princess_roll_call.pdf
    • https://s3.amazonaws.com/gudukupir/logical_reasoning_questions_and_answers_in_tamil.pdf
    • https://uploads.strikinglycdn.com/files/ddcaa5ed-1825-409f-b6bb-8cc17e534a60/sonoma_county_transit_bus_28.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000e3f5.bin
3d0868f971e8bc00a386c60de72da3fd7f4546fefc8cb9c100819280bada3c95		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE3F5 9484 bytes
font_00_sfnt_off0000d175.bin
e6c81ab869b61e8431763ddb4b41797498de04b51c6f3bdd373bbff565cca9d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD175 5436 bytes
font_02_sfnt_off0000fe09.bin
670c5dc09825665e7f91ca2f8d27a2abc885180a85ae770a5076aeb3deb8d44f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE09 12420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.