Malicious PDF — malware analysis report

Static analysis result for SHA-256 41dad8b24c3976ab…

MALICIOUS

PDF

71.4 KB Created: 2021-01-05 21:57:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 8d0fa7d97b236a1376cea0681562c0e5 SHA-1: 80e9347f40287092919e70c32c593b06840e7572 SHA-256: 41dad8b24c3976ab34260cdce3395c91b41d8fb7a2ed5646a5a8df64919e8a06
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://gettraff.ru/aws'. This indicates the document is designed to lead the user to a malicious site. While the document body is heavily obfuscated, the presence of a malicious URL and a high ML classifier score strongly suggest a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?utm_term=honey+mustard+chicken+thigh+sheet+pan+dinner In PDF document text
    • https://cdn-cms.f-static.net/uploads/4454425/normal_5fbb9f9b1dd15.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476954/normal_5fc89900cc6cc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416327/normal_5fa7837f8b207.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381973/normal_5f9b0cbe44fac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475380/normal_5fb60d94188ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415543/normal_5fa18ef0837cc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6dab988a-5b5d-45ba-b2da-ec6761dfe081/19554936046.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/da50e79e-47b2-4924-a947-1cf96c9a2832/bobiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8bbf632-20a4-49e8-b634-abc022be0005/vufipagebozibesenajurib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00650df9-3b2b-4632-a425-9d47ea7abfd3/ihascupquake_minecraft_oasis_map_download.pdfIn PDF document text
    • https://s3.amazonaws.com/sazariwapa/graphing_linear_equations_practice_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9a3115a-e0f0-4dd5-96c1-f3a8ba0a68f0/kinloch_golf_club_membership.pdfIn PDF document text
    • https://s3.amazonaws.com/tawosutosuxi/weight_bearing_exercises_for_seniors.pdfIn PDF document text
    • https://s3.amazonaws.com/juvosi/sovimadulom.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d979.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD979 5580 bytes
SHA-256: 359a14769999fc719257561e5faca9bb1560ded17fb67d2952f0252cb83c6432
font_01_sfnt_off0000ec52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC52 10696 bytes
SHA-256: 40659233bb95d3ef8765339acf8b92bd804c2886c102b03fc83ca4cabc6431e8

Open this report in the interactive analyzer, or submit your own file for analysis.