Malicious PDF — malware analysis report

Static analysis result for SHA-256 caf64943c7aacc27…

MALICIOUS

PDF

34.6 KB Created: 2020-11-07 07:58:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: c907404d9b62ba413dd0fa2950a7f4bb SHA-1: 7c6875f0de2bc139aeadc2994cc4d3190b6edcda SHA-256: caf64943c7aacc27bde932e6b336a155f4776367aa48b521080f9e66d83f25a6
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link to a known malicious redirector, identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The embedded URL, https://traffking.ru/aws?keyword=online+controller+games+unblocked, is the primary indicator of malicious intent. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, appears to contain the same malicious URL, suggesting a lure to trick users into clicking it.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?keyword=online+controller+games+unblocked In PDF document text
    • https://mepuzorow.weebly.com/uploads/1/3/4/5/134500467/bupawasek.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386365/normal_5f9240639c655.pdfIn PDF document text
    • https://vigaziwow.weebly.com/uploads/1/3/4/3/134322068/9463692.pdfIn PDF document text
    • https://kusuxifitumaka.weebly.com/uploads/1/3/4/5/134593182/zasoginotut.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391327/normal_5f95f082c4975.pdfIn PDF document text
    • https://nometiru.weebly.com/uploads/1/3/4/3/134379396/9466737.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0aa0b8e5-2d06-4438-9e95-45f86baf1013/faxugowofotetosibo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4119b9f2-8ec8-4c74-af63-77fe69e1efda/ragnarok_m_eternal_love_assassin_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c962cc53-68d2-48c7-95f8-314820db5616/micro_application_5057_word.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09656a5d-462d-439f-86b9-debf4c07cd29/63383328878.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5955c21a-b1a6-4f81-a156-df4ad998429c/93023939854.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac3f317e-e5b1-4123-b5ef-1dfbdc6eefe8/bivabewixemejufuxudedoguz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9001e61-0e48-4170-a171-dc1c1a697c4e/48233306115.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004839.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4839 5492 bytes
SHA-256: cf86aadaa52d8003bf1c28d25ca6fd19526beefbf4a0be4a729e6697ed7d9a22
font_01_sfnt_off00005aca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5ACA 10256 bytes
SHA-256: 730b2555cdaa54ee657eb323786766410e90912112f7c073681fdd0c1102ae71

Open this report in the interactive analyzer, or submit your own file for analysis.