Malicious PDF — malware analysis report

Static analysis result for SHA-256 06f905d844faacb6…

MALICIOUS

PDF

43.0 KB Created: 2020-11-07 17:54:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc47f439f9a3cc62769bf9608ec74bc1 SHA-1: 1b7a3fa5cb428db9db2cf8a3f50147e5ae3f9a3f SHA-256: 06f905d844faacb653ee05fadcf0662ebdc96cce3e63641732f5f9aefe0f6537
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is a common tactic for phishing or malware distribution. The embedded URL `https://gettraff.ru/123?keyword=concept+map+organic+compounds+answer+key` is flagged as malicious. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains this URL, suggesting an attempt to lure the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?keyword=concept+map+organic+compounds+answer+key
    • https://cdn-cms.f-static.net/uploads/4381997/normal_5f920c05b5bff.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/piwanisaj/ecology_textbook.pdf
    • https://uploads.strikinglycdn.com/files/3284c605-d569-476c-b5e4-70802914b683/febexa.pdf
    • https://uploads.strikinglycdn.com/files/33abae0e-1a4f-4957-9d29-422b902ff233/rare_item_monday_animal_jam.pdf
    • https://uploads.strikinglycdn.com/files/c13a179b-7eeb-4f7a-be1b-ff4a397b5ad4/96227044909.pdf
    • https://s3.amazonaws.com/ropuba/proton_symbol_aleks.pdf
    • https://s3.amazonaws.com/zirojopemup/skin_swapper_free_download.pdf
    • https://uploads.strikinglycdn.com/files/e695616a-e6f4-497a-a147-83ba6a6689e8/dvd_changer_reviews.pdf
    • https://s3.amazonaws.com/zuxadol/11614902076.pdf
    • https://s3.amazonaws.com/vonuxagupeduze/25944359822.pdf
    • https://s3.amazonaws.com/xidulumexi/planet_hot_wheels_code.pdf
    • https://uploads.strikinglycdn.com/files/69a94f44-ccd2-418f-96d9-fd69d5b3e213/wicked_witch_of_the_north_wizard_of_oz.pdf
    • https://uploads.strikinglycdn.com/files/95d58e12-a3e6-46e2-b1b9-e2685f925cd1/portfolio_examples_marketing.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069d7.bin
af8377674ce4eddfcead1b031dcb24986efa02782830a6a52fe3c33864e71c3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69D7 5524 bytes
font_01_sfnt_off00007ca2.bin
82a340b48d6612a91209c6cfbdf37d376063d25b9e65943541d222c81f4c0d40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CA2 10100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.