Malicious PDF — malware analysis report

Static analysis result for SHA-256 b55fc30fdc6d78f3…

MALICIOUS

PDF

66.3 KB Created: 2020-12-17 16:13:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 7c54c86fdea19aae1bd3b632bacdf950 SHA-1: 2f9e31fcde0cb565d1572bb19d5fd197cd58989e SHA-256: b55fc30fdc6d78f35a40e8259eb19fcbf5b059ef3145ba9ff5cab0e75873c819
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://traffmen.ru/aws?utm_term=pf+withdrawal+form+pdf+2019'. This URL is likely used to deliver a phishing page or download a second-stage payload. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of a malicious URL is sufficient evidence of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?utm_term=pf+withdrawal+form+pdf+2019 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4410217/normal_5fd1002467b67.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445726/normal_5fd8f73087cfa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367648/normal_5f874e2b4dfc2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387242/normal_5fad93f6da665.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc37bef1c8c7413144260fb/t/5fc581db18e72e5fdb93c123/1606779356460/zero_order_kinetics_example_problem.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2bc6ebf71053ccb1bf174/t/5fd01bd5a4b4ef2db699d4d2/1607474134903/.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ec0c73d-18eb-43b5-ac92-da16b6b0faf0/vedawogoxof.pdfIn PDF document text
    • https://s3.amazonaws.com/gezejoputiwinu/82506780200.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23bc4d0a-eb6e-4016-b750-5ed109b1549a/ropivojizeleverelobi.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc53c36ff13940aa25c01d5/t/5fc6157a4e98326c02e19e21/1606817147369/circle_theorems_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/gupojakami/cbse_marksheet_verification_process.pdfIn PDF document text
    • https://s3.amazonaws.com/bufexa/61404051137.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc70aeab2e29c7ba991be9b/t/5fcc62b9c836a917f903d6b9/1607230137787/dealsdirect247_email_address.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c440.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC440 5676 bytes
SHA-256: e036302854817cf727616a5456a7ee94dfd0a39397242020605253aa9b689c26
font_01_sfnt_off0000d77c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD77C 10908 bytes
SHA-256: 49be547abc00fa43cfc9c7bb3a2aa50fda93f80d3cd55ae89f8a40ec15d8a8e7

Open this report in the interactive analyzer, or submit your own file for analysis.