Malicious PDF — malware analysis report

Static analysis result for SHA-256 786511c8910e1cf2…

MALICIOUS

PDF

40.7 KB Created: 2020-10-08 03:49:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: b2b8056c01249a64a31dd775fffd4b1c SHA-1: ac7fc7bade51b261acc9df9ce77e3a80008cba98 SHA-256: 786511c8910e1cf247ca71c27e6cd8f1678ef7266db376449d59062a6352c347
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, many of which point to external PDF files hosted on various platforms. One of the primary links, https://gettraff.ru/strik?keyword=advance+bravely+ep+10+eng+sub, is identified as a malicious redirector. This suggests the document is part of a link farm or SEO manipulation scheme designed to drive traffic to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=advance+bravely+ep+10+eng+sub In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/5937/9875/files/liminulogariro.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0477/3399/7724/files/mejizaxofutijenisuwen.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0459/6534/4935/files/bajovovegamiwadog.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/9227/9445/files/13544881364.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/8462/7614/files/bitazot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94de06be-68a5-4191-8c99-c15fdd7f97ee/turuzazepotavez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc23e4cc-bac6-488c-a6ae-0f1a2b808205/xasutodemojizogiwejeses.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b729bfc-4f06-4f83-b35f-ce77ebd63493/lovewimelem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/407c2fb4-9dcc-4f29-b247-32fb90d983d5/basekifofis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f881e8d-d00b-408d-86e1-f09eb2d9756d/67736823025.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/9280/7332/files/license_to_drive_movie_heather_graham.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/8991/2218/files/lilo_and_stitch_jumbas_ship.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/5621/7750/files/9502836547.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/2491/6388/files/ritevevekox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e576b36d-2c87-4674-9e63-5b3e228bd4bc/tipokukekigi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd48a65f-0ecf-49d4-b2bb-5e8e4bb5e0c2/46265354440.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1aba8ee3-9419-4418-be22-68b4bec7d081/88080232644.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9aaee406-aee1-420c-8ecc-30330ded33f5/25409609743.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004959.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4959 6992 bytes
SHA-256: e5f2e9e02b741ed067c635a4e6bc0225cafead5749225fce39dda7f1fba9639a
font_01_sfnt_off000060e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60E0 5724 bytes
SHA-256: 1fbae9edf04b1df8fbfa932a7f49c2be4bb6c8715836f8bdbfb4cf519db215a9
font_02_sfnt_off0000747c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x747C 9584 bytes
SHA-256: 3ff5874da51a874ccd2adc741fe02f175bfaea34932124fbe2da9f7241e9cdbf

Open this report in the interactive analyzer, or submit your own file for analysis.