Malicious PDF — malware analysis report

Static analysis result for SHA-256 f39e2ffb4dcb6055…

MALICIOUS

PDF

26.0 KB Created: 2020-11-03 10:51:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 42e9fbf0f77e8a08ef1483c2e025c25b SHA-1: 479f44e65d1b9ec7282caf0fb8f047f7f7a79581 SHA-256: f39e2ffb4dcb6055d119aac4344412ef9f1bbee3bfb3fad1d812dcb50e73744d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that is flagged as a malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains the same URL, suggesting an attempt to lure the user to a malicious site. No scripts were extracted, but the presence of a malicious URL is sufficient evidence of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=diamond+dolls+movie
    • https://cdn-cms.f-static.net/uploads/4427097/normal_5f9cde6b8165e.pdf
    • https://pawusimogi.weebly.com/uploads/1/3/4/4/134444718/bozawo.pdf
    • https://cdn-cms.f-static.net/uploads/4369173/normal_5f891f2763bbc.pdf
    • https://kusebedanosude.weebly.com/uploads/1/3/1/1/131163667/nogavafarexe.pdf
    • https://kaxebovirufuj.weebly.com/uploads/1/3/4/3/134399635/bamapuxemabo.pdf
    • https://diziwupufetut.weebly.com/uploads/1/3/4/4/134477772/pabibuzilalonak-tasukijog-bunuduti-bagunevegoximus.pdf
    • https://cdn-cms.f-static.net/uploads/4409602/normal_5f9498242c4a4.pdf
    • https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/tomupugu.pdf
    • https://fofupapezu.weebly.com/uploads/1/3/4/3/134356394/sebig.pdf
    • https://rixokofumi.weebly.com/uploads/1/3/1/3/131380985/dijasanoruxajib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0499/9230/2743/files/ao_smith_gas_water_heater_manual.pdf
    • https://uploads.strikinglycdn.com/files/b802c8b9-7e31-403a-a29c-ff09a8ae3a16/vopenux.pdf
    • https://cdn.shopify.com/s/files/1/0481/8966/9533/files/gemcraft_frostborn_wrath_guide_h4.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e80.bin
006824d08197d1c4dd4551d3a5a1ddac32068698b6335ea7697ca61743671dc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E80 4936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.