Malicious PDF — malware analysis report

Static analysis result for SHA-256 f68c42f421c5c56b…

MALICIOUS

PDF

76.0 KB Created: 2020-11-09 17:39:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 021fa513e3e0195595006a0ebc57acc8 SHA-1: 1cb5013001a806786906c4cb6357af247019f9a1 SHA-256: f68c42f421c5c56b5c4f85da17e63f8c797a103458882217b4a764475132969a
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains embedded links, one of which, https://cctraff.ru/123?keyword=can+you+grow+marijuana+in+a+greenhouse, is flagged as a malicious redirector. The document body, though heavily obfuscated, suggests a lure related to growing marijuana in a greenhouse. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or delivering a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=can+you+grow+marijuana+in+a+greenhouse
    • https://cdn-cms.f-static.net/uploads/4374704/normal_5f8a050e25afb.pdf
    • https://lopuzidijunusi.weebly.com/uploads/1/3/4/3/134378181/131dc3.pdf
    • https://kilunifogewawo.weebly.com/uploads/1/3/4/4/134457757/8ac893.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/0c18874847f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/e5a3ca2b-6570-4d40-b41f-a31d2b42a351/windows_media_center_program_guide_2020.pdf
    • https://uploads.strikinglycdn.com/files/13ad0771-9c55-4d7c-b803-268cc785561e/dan_and_shay_speechless_piano_sheet.pdf
    • https://uploads.strikinglycdn.com/files/3d7e0c9c-78c7-4aaf-802c-25ea10e8a35f/76078489184.pdf
    • https://s3.amazonaws.com/gatiwaraluva/san_antonio_high_school_baseball_standings.pdf
    • https://s3.amazonaws.com/banula/wagner_paint_eater_near_me.pdf
    • https://s3.amazonaws.com/mefadedosuw/jejilutokevuwebipavedidij.pdf
    • https://uploads.strikinglycdn.com/files/5796b0c3-57e9-41a6-9854-530f6076ccd0/zudipo.pdf
    • https://s3.amazonaws.com/jimugivos/51310197196.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e16c.bin
17baa438b466b9a2b307be82a172597e42039e592901cb75e6c697656e7ca790		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE16C 5160 bytes
font_01_sfnt_off0000f2e1.bin
b719f1c5702f45966abb9d2373753967750b7f79bf7ba2ec6fb0cf964138f4b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E1 10068 bytes
font_02_sfnt_off0001153c.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1153C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.