Malicious PDF — malware analysis report

Static analysis result for SHA-256 c394eacbaa4f000a…

MALICIOUS

PDF

67.2 KB Created: 2020-12-06 04:31:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0ef8b0546309d5e85870a0bd1f32488d SHA-1: 2cc266abdfe05657eb036cc3db16fea41c551eac SHA-256: c394eacbaa4f000a7bb5c53ed931e48d9efb02d5e07393a349884e3b358a2ac4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://traffmen.ru/strik?utm_term=poultney+high+school+athletics'. This URL is the primary indicator of malicious intent, suggesting the document is designed to lure users to a compromised or malicious site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?utm_term=poultney+high+school+athletics
    • https://cdn-cms.f-static.net/uploads/4382201/normal_5f8f3fc5e7ca2.pdf
    • https://cdn-cms.f-static.net/uploads/4374986/normal_5f8af20ac9fcd.pdf
    • https://cdn-cms.f-static.net/uploads/4393752/normal_5f8f153f021e4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fc19a8f40f1034a5caddecf/t/5fc337a4cb3e0f5771b8e35f/1606629284998/the_story_and_its_writer_download.pdf
    • https://static1.squarespace.com/static/5fc28fbed26ff1194f7e5808/t/5fc403f4f81c9a2a0c1ed1b4/1606681594665/83346485348.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd160c4f07da69d6423aac/1606227476326/exception_processing_message_0xc000007b_parameters_windows_10.pdf
    • https://static1.squarespace.com/static/5fc0012c12facd59cea80d2a/t/5fc1000c3c02f22b9d30d879/1606483980554/thongs_are_not_comfortable.pdf
    • https://static1.squarespace.com/static/5fc296788787e8798976c150/t/5fc8a2bc7ff5a343ebf9ffe9/1606984381590/winter_coffin_nails_2020.pdf
    • https://static1.squarespace.com/static/5fc0d6092e537a05ef08bc6e/t/5fc1099e1972c46e3cc33dfe/1606486432035/dadobaxarodatokakuze.pdf
    • https://static1.squarespace.com/static/5fc110906609fd0ee7923de0/t/5fc126e02dd96f591818ac9d/1606493921594/bostitch_nail_gun_manual.pdf
    • https://s3.amazonaws.com/pokorevalaxex/w3schools_web_design_templates.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf0afef3361272aead641/1606217903418/68270426075.pdf
    • https://static1.squarespace.com/static/5fc6743f88c99b6d37cd7f20/t/5fc75ee94f9413233b205774/1606901482759/jimukeve.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000caac.bin
4ddbe3588c6b1a5c1abfc27cf791cb18271b1aae9d892e36dec208e815502a67		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCAAC 5068 bytes
font_01_sfnt_off0000dbf7.bin
ff68ca2c7156653caf8cf3fa75caf54944274a49a22b547c8fe879bdd0dd69eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBF7 10760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.