Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc373824286cf29d…

MALICIOUS

PDF

34.7 KB Created: 2020-11-02 17:57:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 36de2f598eed1810a610230facc26383 SHA-1: f18f77248bb66e16d104a15a33655e26fc8ea261 SHA-256: bc373824286cf29d3e21bf6f9e925189cceec4199d0171e2c6158348dfea7dd0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. One of the embedded links redirects to a suspicious URL, 'https://cctraff.ru/aws?keyword=nouns+that+start+with+o+to+describe+a+person', which is flagged as a malicious redirector. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=nouns+that+start+with+o+to+describe+a+person
    • https://cdn-cms.f-static.net/uploads/4415936/normal_5f966cc84cd08.pdf
    • https://cdn-cms.f-static.net/uploads/4386837/normal_5f91c600e0e90.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/febopa/modul.pdf
    • https://cdn.shopify.com/s/files/1/0428/4894/4295/files/black_codes_and_jim_crow_laws.pdf
    • https://cdn.shopify.com/s/files/1/0481/6984/4903/files/9100382253.pdf
    • https://s3.amazonaws.com/jiguwuzobozobaz/wwe_mayhem_mod_apk.pdf
    • https://cdn.shopify.com/s/files/1/0502/0277/1634/files/racing_cards_price_guide.pdf
    • https://uploads.strikinglycdn.com/files/6d366a22-7053-453b-ae88-4e5cc59d1d6b/rejonakekogalafidesedare.pdf
    • https://s3.amazonaws.com/lekizopiloref/81413989763.pdf
    • https://cdn.shopify.com/s/files/1/0440/5536/3734/files/12610145281.pdf
    • https://s3.amazonaws.com/kudefem/bodybuilding_training_program_for_beginners.pdf
    • https://cdn.shopify.com/s/files/1/0506/5667/3979/files/8993772585.pdf
    • https://s3.amazonaws.com/dobesogum/azad_kashmir_map.pdf
    • https://s3.amazonaws.com/liwafo/17915471533.pdf
    • https://cdn.shopify.com/s/files/1/0505/5443/7817/files/sony_str-k750p_specs.pdf
    • https://s3.amazonaws.com/sugaguxagu/pipedon.pdf
    • https://uploads.strikinglycdn.com/files/e9f566e8-fc66-4bce-aff5-ba50922d7673/20043325730.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e9a.bin
e1412ea16c9e483702f175f1472774e53e1a9070e75e8135744f2bc4942185c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E9A 5328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.