Malicious PDF — malware analysis report

Static analysis result for SHA-256 f929d9355886250c…

MALICIOUS

PDF

65.9 KB Created: 2020-12-11 02:47:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: caa7b4e548c346fe3f81ef30bcaa3e4b SHA-1: f688edfbe72b523981f95d497267b37006aa0316 SHA-256: f929d9355886250c49514e7c0b820c46e02739080a46d767f74d81e220c6722a
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a critical heuristic firing for a malicious redirector link, directing users to `https://cctraff.ru/wb?keyword=columbia%20law%20school%20course%20guide`. It also exhibits characteristics of a PDF link farm, with numerous embedded URLs. The ML classifier and ClamAV detection further support its malicious nature, indicating it is likely a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9757

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/wb?keyword=columbia%20law%20school%20course%20guide In PDF document text
    • https://vasinurevesodux.weebly.com/uploads/1/3/4/6/134605286/e305197.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366623/normal_5fd2aceccf123.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495254/normal_5fd1e3b6d4f86.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383804/normal_5fb6736a929b3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4994c89b-14f3-4a50-9bff-ed2174256d3b/miller_park_billy_joel_concert.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/opera_browser_for_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b91817e-edc3-4d0f-b188-d83fc5dae0bf/23935011282.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/883e38ea-8fa3-4edb-a03e-2ef4abefd01f/99413812697.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/325989ab-4372-4af0-8c12-a81da861fb42/david_brown_990_selectamatic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e881981-190e-4bfd-af75-5371737f3d00/singer_sewing_machine_model_3337_user_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6aae9430-aa5a-4951-a995-78c07130a911/suratasuxipig.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45671da7-2534-4008-917b-df15c6d41546/50992271247.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD2DE 5492 bytes
SHA-256: f44219127b979379972ba2ae02b895ba33283fed0e568ca811369113119cfb8c
font_01_sfnt_off0000e565.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE565 10964 bytes
SHA-256: b2bf221d8cc4576948d386060c154dee1220ffd02e5c833ded1de594ae1f809c