Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3e029bdd886d9fe…

MALICIOUS

PDF

50.7 KB Created: 2020-11-03 12:20:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: fd485df254dd75b41250f1a88465f9e5 SHA-1: 9bd72e982d5a6c63bd6c23f92c83990ee8eca230 SHA-256: d3e029bdd886d9fe360b49770d663d38e8f338b191b40f6c46906e83bebea5cf
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also strongly flagged this PDF as malicious. The embedded URL is likely intended to download a second-stage payload or lead the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=cpcs+study+guide+for+free In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365552/normal_5f907f0c975eb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374953/normal_5f9e671c389e8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388620/normal_5f98cee4553db.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385026/normal_5f8f6c1b22c69.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368245/normal_5f8835ebb68b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414161/normal_5f9622bb295b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373517/normal_5f8ea29576d2e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382197/normal_5f978e3d561c0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/network_security_books_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/mubemutolewe/jesinutatoze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af969d46-befe-4ca0-bebd-69c1ccce30f6/larousse_gastronomique_en_espaC3B1ol_epub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a0f3c2f-a1f1-40d7-bb6f-347f140e2ab0/when_are_the_fitness_logs_due_apex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d380e140-4f65-4efa-8cc7-1bf28506c8fc/trails_of_cold_steel_weapons.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007c34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C34 5088 bytes
SHA-256: 20f2110f032a414a17f0527411e6075fc217331e3c0bc399755de109b98c2990
font_01_sfnt_off00008d96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D96 3720 bytes
SHA-256: 6539b129c5cd894636dc8f40f53a156c00c8f46378ab4f137c96d687a1cff6ed
font_02_sfnt_off000098f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98F9 10828 bytes
SHA-256: 25383f15a9113b5445c33ca387df9f91a0f7fc8d9e890df33cebc914424f7041

Open this report in the interactive analyzer, or submit your own file for analysis.