Malicious PDF — malware analysis report

Static analysis result for SHA-256 02626bd6dcfbbed1…

MALICIOUS

PDF

43.7 KB Created: 2020-10-27 14:00:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5409bfc590d0f48900b264cf99bd052 SHA-1: 9cc9bb04efcaf5b6e7e3c43b1e8b58115ffe2325 SHA-256: 02626bd6dcfbbed1d04d367cc11caa272d77a4f255bda2462f353da99770da12
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The embedded URL `https://ggtraff.ru/strik?keyword=mutants+and+masterminds+3rd+edition+character+sheet+fillable` is the primary indicator of this malicious activity. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=mutants+and+masterminds+3rd+edition+character+sheet+fillable
    • https://cdn-cms.f-static.net/uploads/4373778/normal_5f90bfa82c3ff.pdf
    • https://cdn-cms.f-static.net/uploads/4376369/normal_5f898915822dd.pdf
    • https://cdn-cms.f-static.net/uploads/4379491/normal_5f90df2a11554.pdf
    • https://cdn-cms.f-static.net/uploads/4383579/normal_5f97b81d0099a.pdf
    • https://cdn-cms.f-static.net/uploads/4376382/normal_5f93e9c950b4a.pdf
    • https://cdn-cms.f-static.net/uploads/4366958/normal_5f8c3ccb4c26d.pdf
    • https://cdn-cms.f-static.net/uploads/4370073/normal_5f93266f4ec48.pdf
    • https://cdn-cms.f-static.net/uploads/4386836/normal_5f8ccc5e99c0b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/leguvefu/ditibagatozevaf.pdf
    • https://s3.amazonaws.com/gapivegek/basinix.pdf
    • https://s3.amazonaws.com/busutafitufe/academy_stars_3_download.pdf
    • https://s3.amazonaws.com/tinajabizoreguf/scientific_names_of_plants_and_animals_download.pdf
    • https://s3.amazonaws.com/kavalukato/68335475412.pdf
    • https://s3.amazonaws.com/rawesaragegugar/cardiology_intensive_board_review.pdf
    • https://s3.amazonaws.com/sevoga/6973495536.pdf
    • https://s3.amazonaws.com/zirojopemup/28332637782.pdf
    • https://s3.amazonaws.com/numegubowalonan/project_risk_management_cycle.pdf
    • https://s3.amazonaws.com/bupaxomu/incentive_program_for_employees.pdf
    • https://s3.amazonaws.com/tabobujimo/benzoic_acid_uses.pdf
    • https://s3.amazonaws.com/wavunot/68695793487.pdf
    • https://s3.amazonaws.com/jovekus/fidadutusefiluxigona.pdf
    • https://s3.amazonaws.com/tuzamada/free_download_surat_yasin_dan_tahlil.pdf
    • https://s3.amazonaws.com/pafiganovavi/71565392577.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055de.bin
dba8686ba1a4e2438a613f5a6ca9c59ec13b6f5ce08b8d679dd343ac83dc5e4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55DE 5452 bytes
font_01_sfnt_off00006834.bin
f729c578442c3e9f22abad778c2957065f9e71318055cf9c2ea88ecf1d1eea2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6834 13112 bytes
font_02_sfnt_off0000926e.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x926E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.