Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bf972d582d6f002…

MALICIOUS

PDF

42.8 KB Created: 2020-11-04 05:29:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ae8fa302e0418861d6d6b41cd8027b61 SHA-1: 756128dfd7bb5e4a85c1b5abec4c6c87e1d106c6 SHA-256: 1bf972d582d6f00264ff899169a1155d1a22b6d53c4bf06451c35bdba8275fae
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://gettraff.ru/strik?keyword=shut+up+about+harvard+summary+and+analysis', is identified as a primary IOC. The ML classifier also flagged this PDF as malicious with high confidence. The document body contains the same URL, suggesting a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=shut+up+about+harvard+summary+and+analysis
    • https://xodunutejoxefis.weebly.com/uploads/1/3/4/4/134476009/nulatuxodumej.pdf
    • https://miboxijudowisu.weebly.com/uploads/1/3/4/4/134491333/1a09f.pdf
    • https://cdn-cms.f-static.net/uploads/4366398/normal_5f8d5e004c86a.pdf
    • https://cdn-cms.f-static.net/uploads/4366388/normal_5f8ff1312e7f0.pdf
    • https://katubebadidi.weebly.com/uploads/1/3/4/4/134474785/gazagasilu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/38f07e91-73fc-43f5-9b11-ecd046248a79/bekiloga.pdf
    • https://uploads.strikinglycdn.com/files/00e7eab7-d6c6-4cf0-bd76-7923f099ccc4/venexatetezevuradawo.pdf
    • https://uploads.strikinglycdn.com/files/a4ec6df0-85cb-4c18-be6c-13426473364e/jexuvofeririwej.pdf
    • https://s3.amazonaws.com/gidibesuxi/spinal_anaesthesia_technique.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000691a.bin
be27caed2cfe969597d7b00b13c7674bc5c33051e1d90b70a47fcf5fdb8d9438		 pdf-font-stream PDF embedded font (sfnt) at offset 0x691A 5604 bytes
font_01_sfnt_off00007bfb.bin
a9b62939d3e1f2efaa6ffb9f987b05383a748e273df0b4f912f3d2fa970e7612		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BFB 10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.