Malicious PDF — malware analysis report

Static analysis result for SHA-256 dccd3a707dade09f…

MALICIOUS

PDF

57.6 KB Created: 2020-11-04 02:53:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: b24c1bc66b01e4180dcd89e19c32c28c SHA-1: 602670d1318b7eee0c271c902f84d9eb48643194 SHA-256: dccd3a707dade09f38a219b13f5326e3c214ad2ee0621fbbbe78e8c4a1f3fa9b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic firing indicating it is a malicious redirector. The embedded URL, https://cctraff.ru/aws?keyword=to+kill+a+mockingbird+chapter+11+exposition, is the primary indicator of malicious intent, likely leading to a phishing or malware download site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=to+kill+a+mockingbird+chapter+11+exposition In PDF document text
    • https://cdn-cms.f-static.net/uploads/4403689/normal_5f9870196e80b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403539/normal_5f90f7ed260f5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377401/normal_5f89f43c69964.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405184/normal_5fa0c2f4db4d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366041/normal_5f8dd697cb13a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7bd2cb9-c32c-40e4-96d0-41bd53187228/48345813655.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files/pitotivenejanajel.pdfIn PDF document text
    • https://s3.amazonaws.com/sugaguxagu/appraisal_and_evaluation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/491f1629-949a-43a9-aa74-9bf44263b3f8/sistemas_para_medir_angulos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cde6c7d-c291-484f-8e5c-66f45e9f32de/85068904805.pdfIn PDF document text
    • https://s3.amazonaws.com/mujevubutukoxu/32519877100.pdfIn PDF document text
    • https://s3.amazonaws.com/lulelepese/95256977431.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fee03f05-a314-4854-b81a-9fdf63f442bc/91702356355.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54d15bb1-5461-4f7d-ab36-843d8ba18072/kapovutitafipubipegetupe.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwenoxuzasila/dabatugafopazom.pdfIn PDF document text
    • https://s3.amazonaws.com/jazuravazaguz/c.l._stone_unsung_requiem_release_date.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a1d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA1D8 5760 bytes
SHA-256: e1db5280cb96a634c9adb59ac763ad242a9d669e1cc404a4e7c48d1dad223db9
font_01_sfnt_off0000b545.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB545 10496 bytes
SHA-256: 489d39ac902709f95b2232dd3a2801a884b2493c46e5018ca0ae0574ab3bc078

Open this report in the interactive analyzer, or submit your own file for analysis.