Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b4a6c0dfe6df6ea…

MALICIOUS

PDF

34.0 KB Created: 2020-11-04 15:18:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: f74e168b43167c488c66411cc9e5bc76 SHA-1: 559182de938ffebd48767a63081457294feddfcf SHA-256: 7b4a6c0dfe6df6ea04fd4f47fc52e92c571ce158f437c1ac3c0f070de266865b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ggtraff.ru, which is likely intended to lead the user to a malicious site or download. The ML classifier also strongly flagged this PDF as malicious. The document body and embedded artifacts do not provide further actionable intelligence beyond the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=teclado+emoji+descargar In PDF document text
    • https://rabifupokuwu.weebly.com/uploads/1/3/1/1/131164250/c3a547f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367004/normal_5f8c654532434.pdfIn PDF document text
    • https://taxufizewafodo.weebly.com/uploads/1/3/4/4/134477277/kasagiwavatogaj.pdfIn PDF document text
    • https://neziraninev.weebly.com/uploads/1/3/4/5/134502601/963d91da34.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jazofi/koxero.pdfIn PDF document text
    • https://s3.amazonaws.com/fezenur/90647066759.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/bihar_si_syllabus_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0644384b-8ab9-48bd-84a9-b6f5a674399a/xenelezisijuluzitured.pdfIn PDF document text
    • https://s3.amazonaws.com/banula/alif_novel_episode_7_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46DF 5284 bytes
SHA-256: 49d1417eb5b27613e54d96bcedc507a341ff9f7bf2224270f5519027fd461079
font_01_sfnt_off000058c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58C2 10396 bytes
SHA-256: ae2129ce48fe6e80de48220cb8d11c8616dca978145181273ae36c00747cb13f

Open this report in the interactive analyzer, or submit your own file for analysis.