Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcb23bd1925093b2…

MALICIOUS

PDF

48.0 KB Created: 2020-10-27 22:54:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 766bbaa8337a5e1b5e6decd16587d520 SHA-1: e41ab339726dd7a24ffc6705167eec3baed78704 SHA-256: bcb23bd1925093b2043ec12b180ddcc54373001dce21aa18ecd52e0c46d057a1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating an attempt to lead the user to a harmful site. The document body, though heavily obfuscated, contains the same URL and a benign-looking title, suggesting a lure. No scripts were extracted, but the presence of a malicious URL and the PDF structure strongly suggest a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9712

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=liger+zero+panzer+review In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369656/normal_5f93e84d32997.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388842/normal_5f8ea2251bdcc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366666/normal_5f8741dc57bd4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369331/normal_5f88299a4f715.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379485/normal_5f8e2b787d616.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403418/normal_5f985497458af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391001/normal_5f8e4bd077ed6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403413/normal_5f97609da5df9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0495/9571/1651/files/75th_year_anniversary_color.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/4214/6984/files/me_and_bobby_mcgee_ukulele_chords.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/2742/9536/files/sesijetefazepufibetoj.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/7481/7693/files/registers_of_scotland_registration_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24f50f8e-93e2-40a1-aee7-ab26a6c0fcb3/vawazivaroboxul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcf4f57e-d7c4-4a9d-8b60-e09a0031f083/webavorusepesejotixamixa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15be380f-47cb-4874-be7d-12a530a05160/life_of_brian_free_full_movie_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88571589-6924-4823-87df-27bb6b2023fd/49785943949.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6ebca14-f95d-4810-a5f3-a54b53d8e091/55148955877.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e529b8c-e83c-4a96-b42f-6fb072db80aa/latun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5546bb9-2e8d-4fd3-a9b9-a0ea44309bea/xifemezuput.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac511ad6-1533-4376-9d10-d52d4ade0510/82324966131.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12165c1c-1dc8-4ddb-bf08-1c3d1ff6adae/tofupavitupugule.pdfIn PDF document text
    • https://s3.amazonaws.com/mijedusovineti/44895991539.pdfIn PDF document text
    • https://s3.amazonaws.com/pesetufavo/88818303451.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/nexaki.pdfIn PDF document text
    • https://s3.amazonaws.com/wonoti/vonuguvasisa.pdfIn PDF document text
    • https://s3.amazonaws.com/wonoti/auditoria_contbil_fiscal.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007410.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7410 4876 bytes
SHA-256: 450f581b5668732a6d288de20d726b1b0b59853531759abe504730fb3200a8e6
font_01_sfnt_off000084d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84D3 4920 bytes
SHA-256: fa3d2813fade5432fa92a0b941523767a0ad39ca7c969baff053ef050271fe7b
font_02_sfnt_off000095c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x95C8 15196 bytes
SHA-256: b4b1a5b17cea3c69f37e3215bd5b3b61d2b3770e0cbbaadd2e62c0fa687b9c88

Open this report in the interactive analyzer, or submit your own file for analysis.