Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c0b7168faeb8d39…

MALICIOUS

PDF

70.2 KB Created: 2020-12-30 00:41:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b65c4676d1dd71a99650555f01290f02 SHA-1: 2c794d15f5c8bcdd0738ade57570425b0101d210 SHA-256: 7c0b7168faeb8d39caa26e08c59b592e7f2629ad9887e8ce1bf1bee6c1f5eb04
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure, specifically 'https://ggtraff.ru/strik?utm_term=cbs+franchise+baseball+2020'. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0'. The ML classifier strongly flagged this PDF as malicious. These indicators suggest the primary purpose is to redirect the user to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?utm_term=cbs+franchise+baseball+2020
    • https://cdn.sqhk.co/sirejeforox/1bdjcjj/2130747023.pdf
    • https://cdn.sqhk.co/lidupusumoj/WYHPEEy/find_word_puzzle_games_online.pdf
    • https://cdn-cms.f-static.net/uploads/4403938/normal_5f9b727c75486.pdf
    • https://cdn-cms.f-static.net/uploads/4461250/normal_5faa21886962e.pdf
    • https://cdn.sqhk.co/leburogutu/4ijhjyh/b_52_bomber_restaurant_costa_rica.pdf
    • https://cdn-cms.f-static.net/uploads/4389352/normal_5f985b704b1dc.pdf
    • https://cdn.sqhk.co/kixituvelil/5Yrhfgg/fisuwewuduvevuwez.pdf
    • https://cdn.sqhk.co/zafupusapun/Ygghjve/miveninabizazaz.pdf
    • https://cdn.sqhk.co/zereseful/hgI4nIX/vaxozov.pdf
    • https://cdn-cms.f-static.net/uploads/4412780/normal_5fa3e31d294e8.pdf
    • https://static.s123-cdn-static.com/uploads/4390071/normal_5fc5c53da5f4b.pdf
    • https://cdn-cms.f-static.net/uploads/4477626/normal_5fd8eb061dced.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/21bc53b6-e50c-4fcd-bab2-a3adb0a913b5/sistema_operativo_macintosh.pdf
    • https://s3.amazonaws.com/jeponowon/lubaralipidujuxixirusumis.pdf
    • https://uploads.strikinglycdn.com/files/7bc36d4a-daeb-41e6-8e2f-9414cddaea36/nike_aire_max_tailwind_6_negro_women.pdf
    • https://s3.amazonaws.com/kovozenamofox/baldur_s_gate_ee_quest_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb92.bin
3c7a3ac502cffa16a88df423febc8c5883788725929c1ad7b63d9aa9572c16bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB92 5004 bytes
font_01_sfnt_off0000dc73.bin
4aa90997a3ffc659a9953fa40cd31bdd584e2a66a55055af3f8faf08c3569d00		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC73 9740 bytes
font_02_sfnt_off0000fdd8.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDD8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.