Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfeca9c77e232d08…

MALICIOUS

PDF

65.6 KB Created: 2020-12-18 02:54:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 98e431ad261fcb40e06ddd69c771de19 SHA-1: 34ad49420219ae1661d5360abea2db58586e52ed SHA-256: dfeca9c77e232d084b53fa0847503d7204345015d1542efefa6dd017aa79c3ce
102 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://traffking.ru/strik'. This indicates the document is designed to lead the user to a malicious site. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of a malicious URL and the document's structure suggest an attempt to exploit the user via a malicious attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=pediatric+nutrition+care+manual In PDF document text
    • https://cdn-cms.f-static.net/uploads/4443799/normal_5fa1f4e3b97b1.pdfIn PDF document text
    • https://vebaruroximowut.weebly.com/uploads/1/3/4/3/134342498/wuxim-jexagotis-xafofedurugo-bewitonalosiga.pdfIn PDF document text
    • https://moramiwise.weebly.com/uploads/1/3/4/7/134736235/a11f1a2e64696.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417988/normal_5fadeab95a4ce.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wixikarago/animal_cell_and_plant_cell_test_worksheet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e60b24b06a7eb3ff207b/t/5fc1afb29d79364840cd24e9/1606528947507/83236047399.pdfIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/linux_bash_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe4a1ff81c9a2a0c6f61ec/1606306335520/the_princess_bride_by_s_morgenstern_unabridged.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf61c018e72e5fdbcf8c46/1606377920858/19292593049.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1ceb7bdb33045eec8b031/t/5fc913018cb1a632eb19b3b7/1607013126027/55434267291.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5c6408845d092481e557/1606376548970/hobs_fall_cave_save_larina.pdfIn PDF document text
    • https://s3.amazonaws.com/tigovatolis/buxebudetadanusureniz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c302.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC302 4908 bytes
SHA-256: b940332f2b045431dd6c173209d1317a5b84617da82ea4f30e6439b7a42093a9
font_01_sfnt_off0000d39c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD39C 10684 bytes
SHA-256: 3cc7476fb49e956c561cab5e4cf20e8cf75950f176322d43ce8e9f2e27ec31d6

Open this report in the interactive analyzer, or submit your own file for analysis.