Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c7e162d6c55f92c…

MALICIOUS

PDF

68.4 KB Created: 2020-11-24 07:52:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 1d082aac2812de3b55d6b42a34e21cca SHA-1: 2c2a8624ee9a02981b0acbee82d5a00f82155b25 SHA-256: 4c7e162d6c55f92ce1091aaa23ad4e2be4d88e0491c6e72854711880c8c4e296
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one critical heuristic identifying it as a malicious redirector. The primary malicious URL, 'https://ggtraff.ru/aws?utm_term=brick+breaker+puzzle+mod+apk+revdl', is a key indicator of malicious intent. Another heuristic indicates a PDF link farm, suggesting a broad distribution attempt. The ML classifier and ClamAV detection strongly support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=brick+breaker+puzzle+mod+apk+revdl In PDF document text
    • https://cdn-cms.f-static.net/uploads/4414672/normal_5f9f01e59b7d7.pdfIn PDF document text
    • https://teguzefememefa.weebly.com/uploads/1/3/4/6/134609716/dac1b88ad4836c.pdfIn PDF document text
    • https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/f27f3dd6641.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6c04a30-23f5-4dce-902d-7a250f7124f7/wigejutud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53a8be42-3af2-46a0-950a-6aed61137e5f/trumans_scientific_guide_to_pest_management_operations_6th_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d061a4b-9d65-4960-9e0b-0bfd41d1ec8a/2014_acura_mdx.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50ed7927-ccaa-4486-80bc-24f4f229c29e/math_simple_solutions_grade_7_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e2c1b60-470b-447c-b31c-2163058f883f/68432035089.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b99a0224-8703-413f-8cbe-38f4e567e08d/92127353844.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d48b116c-a867-4746-809c-8c1c3f6eb30f/16116599813.pdfIn PDF document text
    • https://s3.amazonaws.com/nerugiraxura/accounting_application_software.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7458449b-07d5-41d9-bb4f-c77600fe75f0/purble_place_descargar_para_celular.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62fce068-308c-4031-8d81-f150b20fcf8f/31381787052.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/35183ca8-b777-4798-8620-b94fdb77af15/wakanuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d32fd024-2091-400b-8a93-bf34024fea69/30639647424.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD48 5404 bytes
SHA-256: 88465075d3173448ee940bc43c6187cda1f5e3576c709ad28cedc0e431bd7ebf
font_01_sfnt_off0000dfa0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFA0 10792 bytes
SHA-256: 7392f125743a225f7bc8c17434a0a3ca8b55fbed965637eaaca0da7714b1b3e5

Open this report in the interactive analyzer, or submit your own file for analysis.