Malicious PDF — malware analysis report

Static analysis result for SHA-256 36bd37a4dc9d5e13…

MALICIOUS

PDF

41.8 KB Created: 2020-11-04 15:09:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: cd8f6d505c0e8a37a64a9fa44993e5b1 SHA-1: 270ab3f5d8159a46b9d59eccc33941d512a5be0f SHA-256: 36bd37a4dc9d5e138ed7446bfbe2463f4969839d80eda3ec32cddd3e054a7cdc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains a large number of embedded links, with one identified as a known malicious redirector. The document body, though partially obfuscated, includes the URL 'https://gettraff.ru/aws?keyword=horse+eventing+game', suggesting an attempt to direct users to malicious infrastructure. The heuristic 'PDF_SEO_LINK_FARM' further indicates a mass of external links, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=horse+eventing+game In PDF document text
    • https://kapekutom.weebly.com/uploads/1/3/4/4/134437999/5595121.pdfIn PDF document text
    • https://vapaniwagivu.weebly.com/uploads/1/3/4/4/134442769/ziranu-vituwasapubadu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/958723e5-0568-4e90-8a6d-59f2b2cea94a/65598959197.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a47d6e0-fa6e-46c2-b816-804f10381d59/39395536761.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f686a28-ac16-4f9a-a2b7-1fc1782bbfa0/adobe_creative_cloud_login_keeps_popping_up.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a74c7713-8a05-42b4-8255-3e1db2814fa7/rebasusuk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/8116/3438/files/tuzotixefabodekezilib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/845d03ed-4027-44c2-89bb-67c621db9e16/numap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd0b05fd-1534-4acf-acb7-10231941db1d/chemistry_a_molecular_approach_4th_e.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db14b79c-9ae4-4dc1-8c6d-8a473d277cae/70350621594.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d5ad778-82d3-4eec-9e8e-f980d6a93a95/dickinson_faith_is_a_fine_invention_analysis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e48d8668-b1c5-4eb1-80e9-64ddf0f59be7/jutupatuzedadovofomupo.pdfIn PDF document text
    • https://s3.amazonaws.com/midaguvimabof/52499795503.pdfIn PDF document text
    • https://s3.amazonaws.com/fifuto/1155456923.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae4dd0c4-9d58-45e1-8b02-915857a25dd8/35904994259.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62ac36d7-a71c-4a52-ab13-1e8f74d82c56/everstart_battery_charger_codes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000666c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x666C 4996 bytes
SHA-256: 31048da70ccdc1cfd3a9ae2e951cf1e137d6a57066e106d8073b1c3ee39548df
font_01_sfnt_off0000775b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x775B 10296 bytes
SHA-256: f3a9f61cb77526817f907c8e5921f665af8c0357f2f8276f2b03b5350e221dc3

Open this report in the interactive analyzer, or submit your own file for analysis.