PDF malware analysis — malicious · 4cff3df2c506fbeb

MALICIOUS

PDF

28.3 KB Created: 2020-11-08 19:39:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: af1543e3a442fa4ac76870a9da0bad43 SHA-1: a8cbba3f737574d223c59ad39b36ff74ca237bed SHA-256: 4cff3df2c506fbebf9d19b30baeaf0897f55a2055dd85b22a1bd2e18e327206d

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ggtraff.ru'. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The ML classifier also flagged this PDF as malicious. No scripts were extracted, but the presence of a malicious URL indicates an attempt to redirect the user to a harmful site.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?keyword=drake+and+josh+smart+girl+full+episode
- https://safasisi.weebly.com/uploads/1/3/4/4/134472516/4da58.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/jibigamefomoni.pdf
- https://jatilesaza.weebly.com/uploads/1/3/4/3/134316516/b6097.pdf
- https://besiwalufeg.weebly.com/uploads/1/3/2/6/132696214/7342046.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/5688bb16-1888-452a-9069-96a3bc7623cb/71132522521.pdf
- https://uploads.strikinglycdn.com/files/249707af-bfa2-4459-b707-a84179ca3de6/popatog.pdf
- https://uploads.strikinglycdn.com/files/18794274-df4c-4e78-bf04-afadabf69e35/wisogabu.pdf
- https://uploads.strikinglycdn.com/files/43a61aad-a514-4df5-9993-cf7061cb9484/64792709718.pdf
- https://uploads.strikinglycdn.com/files/3908ad2c-ef99-4159-90c7-48a3008f7f98/74869923825.pdf
- https://s3.amazonaws.com/gizonukorad/xixat.pdf
- https://s3.amazonaws.com/vukusa/walanitiretaneke.pdf
- https://mudupetem.files.wordpress.com/2020/11/20042446963.pdf
- https://s3.amazonaws.com/luropi/pubatajobixoxujusovena.pdf
- https://uploads.strikinglycdn.com/files/d47bded0-cd7b-4dc8-9b48-91cbaec7538c/tupaxidedafexakunojisixit.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004d6e.bin` `69804f737d28a3497f2aa7b2aa503b810cd5e42d041424b5e7df5912de09a27a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4D6E	5596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.