Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bbf378afb8fbd59…

MALICIOUS

PDF

72.7 KB Created: 2020-11-25 15:15:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9dc2ec0b0ee59eb92ae9ed1bca4e99d0 SHA-1: d0da27598f1076bc921db2bd80f4c9e32e870a96 SHA-256: 3bbf378afb8fbd598a05077e288510938dd832db4a67a9b090eaf51839f37da3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://gettraff.ru/strik?utm_term=hacked+war+games+unblocked'. The document body, though partially obfuscated, contains text related to 'hacked war games', suggesting a lure to entice users to click the malicious link. The ML classifier and ClamAV detection further support the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=hacked+war+games+unblocked
    • https://cdn-cms.f-static.net/uploads/4418391/normal_5f986293cc8d4.pdf
    • https://cdn-cms.f-static.net/uploads/4374188/normal_5f91dc44c3e4c.pdf
    • https://cdn-cms.f-static.net/uploads/4369788/normal_5f8e90e29918b.pdf
    • https://cdn-cms.f-static.net/uploads/4373281/normal_5f948a785c962.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://s3.amazonaws.com/zetare/benztropine_davis.pdf
    • https://s3.amazonaws.com/satudifin/20105936826.pdf
    • https://s3.amazonaws.com/sitok/ryobi_10_portable_table_saw_bts20r.pdf
    • https://s3.amazonaws.com/gafedupeba/whs_library_tuhsd.pdf
    • https://s3.amazonaws.com/nonipesikiri/70647253091.pdf
    • https://uploads.strikinglycdn.com/files/a84dd7fb-ce69-4fde-9815-71d0dcf6997a/sivobatudemizidamire.pdf
    • https://uploads.strikinglycdn.com/files/0a57120d-66da-4cbf-b83e-660afffc1cdc/84407207624.pdf
    • https://s3.amazonaws.com/roxawo/le_mays_pizza_poinciana.pdf
    • https://s3.amazonaws.com/pulujolatepuv/reporte_trafico_autopista_mexico_queretaro.pdf
    • https://uploads.strikinglycdn.com/files/522653d3-133a-4667-8b85-d0d890562c02/64054309241.pdf
    • https://uploads.strikinglycdn.com/files/2cff4889-dddf-4b78-b0f4-e9214b56d0ee/sibosagenudajekorinive.pdf
    • https://uploads.strikinglycdn.com/files/6b0b62ec-fa08-441e-9b0a-e73405eb3671/categorical_variable_and_continuous_variable.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9d2.bin
dad3daf13cf436d126c6091cd7aa32fd3d168f0c9a5a7b43d372156434b20b32		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9D2 5516 bytes
font_01_sfnt_off0000dc82.bin
0939d4fecbc7f28d3b79b6962ca860d6aaec00e93fe7e863c3c300c531cf0201		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC82 7228 bytes
font_02_sfnt_off0000f01e.bin
67b40e04c10405724107a2b5a2796ad719101d92036ef35315d75c20a44a6fbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF01E 11424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.