PDF malware analysis — malicious · 29f06908cf440d31

MALICIOUS

PDF

75.5 KB Created: 2021-01-17 06:42:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23

MD5: c6a37ae9757c8360b4cf66f3df692809 SHA-1: 460a0e63f0468ec216c5b6ab2e0597412e1b8e4f SHA-256: 29f06908cf440d31e7c6c5279a32145e0288a1fd2072e0179b5679b2be77d02c

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'ggtraff.ru'. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the presence of a malicious URL suggests an attempt to redirect the user to a harmful site, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/wb?keyword=jazz%20free%20internet%20packages%202019 In PDF document text
- https://site-1166701.mozfiles.com/files/1166701/60693010426.pdfIn PDF document text
- https://site-1166659.mozfiles.com/files/1166659/57677340487.pdfIn PDF document text
- https://site-1247942.mozfiles.com/files/1247942/free_printable_giraffe_head_template.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470985/normal_5ff91fde12216.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416150/normal_5f9a6c5b16576.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368493/normal_5f89d68f98aa8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365547/normal_5fafe3cf2dfe9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4424692/normal_5f9b03aa54c7e.pdfIn PDF document text
- https://site-1181117.mozfiles.com/files/1181117/buvan.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/dowavelaxam/bowflex_max_trainer_m7_guide.pdfIn PDF document text
- https://s3.amazonaws.com/rerinago/rangkuman_biologi_sma_lengkap.pdfIn PDF document text
- https://s3.amazonaws.com/mamibis/acet_application_form.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ea06.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA06	5736 bytes
SHA-256: `95db40a0f48381347aea7e2fb38627dfb8ffffca4166b2f35d70f1a8685d1574`
`font_01_sfnt_off0000fdb8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFDB8	10416 bytes
SHA-256: `f20f3b6fc83eb2a0f49ddc49170a1a7e5a717ed7f2bfb242b1c9b15a6cec6183`

Open this report in the interactive analyzer, or submit your own file for analysis.