Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ca0719773b3af08…

MALICIOUS

PDF

96.9 KB Created: 2020-11-24 05:59:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1ade829c983f0073dddd7af7344ad85f SHA-1: d0c0991c29b98e6ede31c2e826bac854637fbec1 SHA-256: 0ca0719773b3af086a9cfa8a6888425743d2be948bcfde914d6745c8496f900e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://gettraff.ru/aws?utm_term=perceived+behavioral+control+pdf'. This indicates the document's primary purpose is to lure the user to a potentially harmful website. The ML classifier also strongly flagged this PDF as malicious, supporting the assessment of a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?utm_term=perceived+behavioral+control+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/lebaxa/dezofufugeferav.pdf
    • https://uploads.strikinglycdn.com/files/1e182371-97d3-4184-a751-adfffb4c9159/meme_compilation_trombone_solo.pdf
    • https://uploads.strikinglycdn.com/files/1719a50a-7fa7-4c5a-9371-df55581c39cf/26093330032.pdf
    • https://s3.amazonaws.com/mozedijiz/23987664284.pdf
    • https://s3.amazonaws.com/jamokaroxoj/mathematical_modelling_in_biology_and_medicine.pdf
    • https://uploads.strikinglycdn.com/files/35bece8c-4c8f-4fdb-8aa1-a88f3272a50d/28495333855.pdf
    • https://uploads.strikinglycdn.com/files/2e1d4266-9286-4eb0-ac7a-08cf0d56e636/nikobufujisatokum.pdf
    • https://s3.amazonaws.com/vebenok/command_and_conquer_renegade_full_game.pdf
    • https://s3.amazonaws.com/nodetuxapabara/juwiweretis.pdf
    • https://uploads.strikinglycdn.com/files/1b34a421-b4dc-42ee-8694-9b42860a11b3/leronubulixifojuxune.pdf
    • https://uploads.strikinglycdn.com/files/d748d654-3a9b-4f29-b17d-9f2428217271/70519704277.pdf
    • https://s3.amazonaws.com/rufonali/wazifagaxanuzoni.pdf
    • https://uploads.strikinglycdn.com/files/94d9c625-3b66-4f27-81bb-0e96be6a94b1/xawupesategobadujoj.pdf
    • https://s3.amazonaws.com/remeranexe/69884353838.pdf
    • https://s3.amazonaws.com/ginutu/xaxafekuzizadavumazatibi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000119d0.bin
f255cbf9b8f40e0ee36aa779fd2e8ad6fccb529efba36183d7043b0efbc68598		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119D0 5056 bytes
font_01_sfnt_off00012ae9.bin
56f7b9af00a39a08edc2aad09bbbf0cd70c0884ef94a7137f3252ccc0761394b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AE9 11840 bytes
font_02_sfnt_off000152ae.bin
74a35dcac671789a1952909c7064e8f0092ccf84988030a41650584fa1b75142		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152AE 16192 bytes
font_03_sfnt_off000167da.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x167DA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.