Malicious PDF — malware analysis report

Static analysis result for SHA-256 04b54a54bcd84784…

MALICIOUS

PDF

47.0 KB Created: 2020-10-24 07:08:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 9cea7d8ee2a116bef483e6b5dacab9ef SHA-1: 98ca2ebe6fe0e789239a5a44011cb543dd605b19 SHA-256: 04b54a54bcd8478446c76850e45764d90b56a4037c9bc9f6f4ff1b4b46214a9e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, https://gettraff.ru/strik?keyword=believer+easy+piano+sheet+music+pdf, is the primary indicator of malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to lure the user to a malicious site, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=believer+easy+piano+sheet+music+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4393791/normal_5f8ea24798ee8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379043/normal_5f91acd530652.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370530/normal_5f8a920ae3e18.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372985/normal_5f8ba7bf2d2ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370266/normal_5f925b11965dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372673/normal_5f8b7c29bc8f0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/65164932-56fa-48ee-aa1c-9f141578af9f/96749547313.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2aeb5f2-fbc6-47b4-878f-e54b7f6aa113/kuwakezinapomu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5b4a7a2-9a9b-46c1-a02b-31f224346eae/80470990786.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/014188b3-8af0-4e6d-8724-983e5e3458ca/ladaradaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31234e5b-02eb-4b2a-8f32-bba26c8ee32f/fosijutazeboposunepopam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f107416-7945-4c47-a13c-42a9d8214dcf/127899897.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/217f17e3-287d-41c8-9d08-dc5253afe1d7/the_cultural_landscape_an_introduction_to_human_geography_9th_edition.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0504/9024/5285/files/dometic_3_way_fridge_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/4246/2618/files/47872227819.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/1329/9102/files/nirumoxumigorazevituno.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0469/3105/0651/files/1482631984.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/9929/4363/files/79481343658.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxadol/5511595827.pdfIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/office_assistant_duties.pdfIn PDF document text
    • https://s3.amazonaws.com/zetare/22503375187.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • https://www.youtube.com/watch?v=6BVkoctT_Hc,tags:[Hungarydude,BeIn PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000068bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68BF 5608 bytes
SHA-256: eebcd09f64d7bc3f0e3dedaa7b51080febd9b69326a08c2a4123bb562d50cfc1
font_01_sfnt_off00007bb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BB9 15764 bytes
SHA-256: d99920612ee0b095568f3c0f2bdeaf959200a3a2fa4f9626ff0d4beb21937f1a

Open this report in the interactive analyzer, or submit your own file for analysis.