Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b78d4baffbc1dc4…

MALICIOUS

PDF

42.8 KB Created: 2020-11-03 11:58:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 6e68230e81383f1548af3beda024b6d9 SHA-1: 9964ec59ca2275ea3f371364e1c7920c662d0cb8 SHA-256: 0b78d4baffbc1dc44aa3801444df349c40a6b7356dd0d78de1710a510bfd17e3
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a link that redirects to malicious infrastructure, masquerading as a free Instagram recovery tool. The ML classifier strongly flagged this PDF as malicious, and the embedded URL is associated with known malicious redirector activity. While no scripts were directly extracted, the nature of the redirect suggests it's intended to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=instagram+recovery+tool+free In PDF document text
    • https://cdn-cms.f-static.net/uploads/4386822/normal_5f9fb35f95414.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366949/normal_5f8b74140727a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380887/normal_5f9d22253148c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382420/normal_5f8fe02688c5b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8bcfc66-fc37-40ba-b132-960e7c30a2d0/jevafiwotatimam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f70e17b-58c9-48a4-a57e-8a5b8ef0bda5/kubos.pdfIn PDF document text
    • https://s3.amazonaws.com/mipizaju/venusta_orchard_spider_poisonous.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/belomazokoxoxi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8db0a52f-542e-4aac-8fb1-750d4c69421d/pijik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dafda191-137f-42dd-98d6-8f7456192bc5/excel_2003_formulas.pdfIn PDF document text
    • https://s3.amazonaws.com/buponuwebi/microsoft_wireless_mouse_5000_scroll_wheel_rubber_replacement.pdfIn PDF document text
    • https://s3.amazonaws.com/tokafanawa/does_fedex_office_offer_notary_services.pdfIn PDF document text
    • https://s3.amazonaws.com/wazorixekunafob/traditional_bulgarian_female_names.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/xilajinegexaburojipaz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x69B1 5300 bytes
SHA-256: dc57fc8b383e3d7915c96548f0b1572adb12245ca696d3d6e8aa8fe28a1ed282
font_01_sfnt_off00007bb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BB7 10156 bytes
SHA-256: d932eafabfc962108950643c4256cb2b54e86966796f76b18b1abf3b33d99388

Open this report in the interactive analyzer, or submit your own file for analysis.