Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ece2ac222e22a75…

MALICIOUS

PDF

50.2 KB Created: 2020-10-20 09:44:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: a7d4910db76bbfcdadc6c7cbbb373206 SHA-1: 21bebcba4026df7cf7238ad12cbb8b252b1cd0a7 SHA-256: 4ece2ac222e22a758e86c097755440aa5a2ddbf1c086e9f0bbee52d4cc4aadac
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged as malicious by multiple heuristics, including a critical alert for linking to known malicious redirector infrastructure. The embedded URL `https://gettraff.ru/123?keyword=picolinato+de+cromo+pdf` is identified as a redirector. The PDF also contains a large number of external links, suggesting a link farm or SEO spamming attempt, with `https://cdn-cms.f-static.net/uploads/4377371/normal_5f8ac1aa4321b.pdf` being one of the identified links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?keyword=picolinato+de+cromo+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4377371/normal_5f8ac1aa4321b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384308/normal_5f8c8edb40106.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374199/normal_5f8b0f27abb2d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365586/normal_5f87e4011b6d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367964/normal_5f89ff4642b80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378606/normal_5f8b57572d70d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370066/normal_5f89fc7386961.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379379/normal_5f8d97d32eb1f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367007/normal_5f8a7152a690c.pdfIn PDF document text
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/6431815.pdfIn PDF document text
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/fubisi.pdfIn PDF document text
    • https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/fa33f1cadd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2171a214-eae1-4ecf-ac8c-6907f4db0189/84940647029.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/138d3733-c519-478b-ab82-5599abea5341/photomatix_pro_4._2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb9fc844-a268-45e5-ba4d-89d69dbc4efb/16840683803.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91822566-27d8-4522-b280-d33ec2fc0e45/93214652989.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46be5003-2bf5-4573-a15e-19d8f60d7d61/12635527912.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d96408b7-2266-47fd-b66a-3af55d699ab1/3331023623.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb7861af-5205-4c9d-b1e0-8a86faa17e34/48533714731.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1501b0c-02ef-46ae-ba6b-9772c288447c/22354635725.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36d4fb2e-5c08-4038-99a7-219b9092cf07/88457040546.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de6b6095-a54d-4533-9c77-9c9d52690c42/60511372569.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7c8e7e5-4800-4ca4-813c-c09bba511261/72197313639.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ced2474c-0188-4fc7-b52c-ff61359fdfd4/xagametepewudino.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000855e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x855E 5124 bytes
SHA-256: 4b02b4c6ac85fb6ff6f9378a9eba230400151c77abd086c297f53bdd552c7b39
font_01_sfnt_off000096a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96A7 10620 bytes
SHA-256: 0b2ae08d8ba64e5a341722aa92ece583d25186b3064a8d50b0a31c02e426f1be

Open this report in the interactive analyzer, or submit your own file for analysis.