Malicious PDF — malware analysis report

Static analysis result for SHA-256 252aba61bc5ca5a6…

MALICIOUS

PDF

78.2 KB Created: 2020-12-23 12:12:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: f22bb3ad038cbc5b5d4c46d67c1447c4 SHA-1: 781ebb910f458741b3bf1a9c115eca5983cb0f5c SHA-256: 252aba61bc5ca5a611e721adb5b009bce8de1f1fc490f7427dfbc7aa036256a8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://traffine.ru/strik?utm_term=pottery+barn+kids+registry' is the primary indicator of malicious intent. The ML classifier also strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=pottery+barn+kids+registry In PDF document text
    • https://cdn-cms.f-static.net/uploads/4453108/normal_5fd7e328cf10e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392661/normal_5fd927a1d2215.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fce663790e5b06becb785e9/t/5fd75e54de5b1220c04908d5/1607949913738/other_matter_paragraph_in_audit_report_icai.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ee18dfc-91b3-43b4-aeb1-1e2aa0945072/93474314800.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc55f712e537a05ef26dfac/t/5fc936d600fa892316ae7a63/1607022295739/inside_out_2011_full_movie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6631d0f-7a62-4893-abae-837a30dc27a1/74016931173.pdfIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/boxelewepedumimafazase.pdfIn PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/bukunmi_eazy_eazy_mp4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7766b84-a4e8-4ba1-b408-ae454a380f64/55604063941.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd06a33fdc31513a1101c8/1606223523350/ggplot_pie_chart_alternatives.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01aa4dfd-e35c-460c-ace1-62ebfed725e2/gatepugefaxuvavawidaxeki.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f53f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF53F 5268 bytes
SHA-256: 983680dfed52a07e36c211a90bb7c2abae1144baf9d42754b5d84018059fc1ad
font_01_sfnt_off00010744.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10744 11036 bytes
SHA-256: 288ba14014ff88980c48a9c9121a35f32750b822102776410ff207015627a627

Open this report in the interactive analyzer, or submit your own file for analysis.