Malicious PDF — malware analysis report

Static analysis result for SHA-256 31c072d8788db1bc…

MALICIOUS

PDF

38.8 KB Created: 2020-10-30 06:09:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: ea79db3ffa2d7c379a8c8c60e1b6e310 SHA-1: b36f26ad4df32520e564c04c9ec5730f95726693 SHA-256: 31c072d8788db1bce781998a03c55e00802d6f6d56a1e132a04b167179de13b5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to external resources, indicating a link farm or SEO abuse tactic. One of the primary links, https://ggtraff.ru/aws?keyword=college+board+ap+human+geography+frq+2018, is flagged as a malicious redirector. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to direct users to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=college+board+ap+human+geography+frq+2018 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4368975/normal_5f8dcf7d841d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414847/normal_5f968bd15d5d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365546/normal_5f8ec270e8eb5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366313/normal_5f8e1f383bc51.pdfIn PDF document text
    • https://dupizonax.weebly.com/uploads/1/3/1/3/131380343/zamep.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/muvemasoxaji/7761666857.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23fe0547-b2ca-46db-9822-196cd4e13562/68475627660.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02e44360-edcb-4a0c-9bd9-a791c1d3c1e6/6936708741.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93c841d1-74a4-433d-a445-4931f73c2ef1/novik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f46f888-1293-434f-9798-214b4d459bb4/31357822667.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82ceeaa5-0161-44d7-8540-c02df88c93af/23949923079.pdfIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/78867328269.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f340608c-363e-4450-b0e6-d552da337bf0/26439928899.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9935ec4a-de9d-4a4b-a1f2-7cf04953b533/abcd_2_full_movie_download_480p_boll.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005943.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5943 6068 bytes
SHA-256: 70c4ae1b1af17f7f9701e730d28247fe6127d61b12c01a99ed5db86874a6d308
font_01_sfnt_off00006dc1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DC1 9420 bytes
SHA-256: fc963ad2278dc5350ab38f6a7cb65c144f52ac697830b1c87f25d8259db85267

Open this report in the interactive analyzer, or submit your own file for analysis.