Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d429439029bf103…

MALICIOUS

PDF

45.7 KB Created: 2020-11-05 04:08:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 672fb929aacb13f619e1eb497c368152 SHA-1: 54faceb0548c280208daa655814a327dde8e4b18 SHA-256: 4d429439029bf1036c83858ea63a5381cdac0ab1f51d618a10c27a69213e95b2
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/123?keyword=drastic+free+apk'. The ML classifier also strongly flagged this PDF as malicious. Although no scripts were explicitly extracted, the presence of a malicious URL within the document body indicates an attempt to lure the user to a potentially harmful site, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/123?keyword=drastic+free+apk
    • https://cdn-cms.f-static.net/uploads/4369664/normal_5f884de6cd48c.pdf
    • https://zebazowis.weebly.com/uploads/1/3/4/3/134310266/menolunix.pdf
    • https://ganunuzarije.weebly.com/uploads/1/3/4/5/134518475/diravuwixe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/suzixegazunow/bestimmte_und_unbestimmte_artikel_bungen_2_klasse.pdf
    • https://s3.amazonaws.com/mesotodimus/43451594949.pdf
    • https://uploads.strikinglycdn.com/files/cf4270ea-56dc-4016-99ee-b45fcae0d0bc/bodarepawoguw.pdf
    • https://s3.amazonaws.com/tevigotu/dofajegesuzim.pdf
    • https://uploads.strikinglycdn.com/files/0a935d92-c38b-4fcc-b391-ddfa32f28e2a/gasuseranesimor.pdf
    • https://s3.amazonaws.com/nilafafakem/i_never_sang_for_my_father_play_script.pdf
    • https://uploads.strikinglycdn.com/files/ea58e2b5-3733-486b-9283-0a82a4da6e37/dixaxob.pdf
    • https://uploads.strikinglycdn.com/files/481bea49-5490-450f-ba06-7e122919f748/vujedizupediwobuteborukik.pdf
    • https://s3.amazonaws.com/lanubili/7701297823.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007422.bin
582c28f1b749f5ac40b6cc1a941f2c1fd6caa2278b45b6806c3dc50d062adae4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7422 5040 bytes
font_01_sfnt_off00008561.bin
0059e62971865b64eb3f80508e851506d10a4b55953e791731a4ba99491382c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8561 11056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.