Malicious PDF — malware analysis report

Static analysis result for SHA-256 e42430b2d217712c…

MALICIOUS

PDF

72.7 KB Created: 2020-12-23 13:39:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: a0fc8d5be283f1e3b96d3062ed217cc3 SHA-1: 9c596c7687a944d07fe9a75829392896d0111307 SHA-256: e42430b2d217712c5eb0dbe5d65bde5ba04d1f98347a2a106f0c3d0546a842a6
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external websites, with at least one identified as malicious redirector infrastructure. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK and ML_NYX_PDF_MALICIOUS strongly indicate malicious intent. The embedded URLs suggest a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=emergency+medical+responder+textbook+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4499299/normal_5fb4de01ed8ea.pdfIn PDF document text
    • https://kusebedanosude.weebly.com/uploads/1/3/1/1/131163667/1970979.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450889/normal_5fb5bf6f26e9c.pdfIn PDF document text
    • https://lalidusuferub.weebly.com/uploads/1/3/4/4/134440540/fudolezasapobodijobe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375525/normal_5fdc3c7331e30.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380229/normal_5f936e9602659.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445733/normal_5fa07703ce6f5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef417628-62ee-4473-b902-f44e765ada45/homestretch_sweepstakes_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3936174-6503-4bff-8c02-4cd00c16f22e/letter_of_recommendation_for_nhs_from_a_coach.pdfIn PDF document text
    • https://s3.amazonaws.com/kozikixoju/96408773920.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85d4a6e2-f16e-4f06-9af3-7b2103144d2e/25684912717.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fe24700-f8cb-4dcf-9df3-cd3c7fa98d73/90163969351.pdfIn PDF document text
    • https://s3.amazonaws.com/fajeloninesitel/shift_heads_world_2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7789d679-d4b8-4b0c-b5d3-fb644fb5499a/vizio_e3d420vx_ir_sensor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd028ab1-43a0-475b-bb41-d639002ded78/hakumei_and_mikochi_hulu.pdfIn PDF document text
    • https://s3.amazonaws.com/tobobowu/ronitoje.pdfIn PDF document text
    • https://s3.amazonaws.com/bevekizadoxuj/zygote_formation_and_development_of_embryo.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/18836234523.pdfIn PDF document text
    • https://s3.amazonaws.com/tibitexil/56259406922.pdfIn PDF document text
    • https://s3.amazonaws.com/xisefowu/new_bollywood_movies_2018_in_filmywap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6176aab2-6900-48e6-af8a-c3d6ff9f0563/talekilulerowotegolu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d960.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD960 5808 bytes
SHA-256: 9c45ac03065e0508341fd967fb918765991ea08c8cfa6a22583f3db6dd1b1d95
font_01_sfnt_off0000ed1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED1F 11468 bytes
SHA-256: 52435c18aec1b775f53a728ba9741b7cf9f6dd2c9bc6397a84dbdb53d1c505f9

Open this report in the interactive analyzer, or submit your own file for analysis.