Malicious PDF — malware analysis report

Static analysis result for SHA-256 880be91ae90d4278…

MALICIOUS

PDF

82.2 KB Created: 2020-12-14 23:19:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 1774d4cbc697dbe8c7d99abad89c224f SHA-1: 059515d2e7edf0fb2def42533e1794b79efa5a7e SHA-256: 880be91ae90d4278a8553a6d24e53101a2e7dd1dc76165c3bd201e47c370a0cd
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The ML classifier also strongly flagged this PDF as malicious. The embedded URL, https://traffine.ru/123?utm_term=colts+neck+high+school+jrotc, is the primary indicator of malicious intent, likely serving as a lure for phishing or to download a secondary payload. No scripts were extracted, but the PDF structure and URL are sufficient indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=colts+neck+high+school+jrotc In PDF document text
    • https://zukamukenipebo.weebly.com/uploads/1/3/1/3/131380388/5750563.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465257/normal_5fd3af48ec9a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374983/normal_5fa143988e500.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383687/normal_5fcb5aed1b47c.pdfIn PDF document text
    • https://dowazulipogopu.weebly.com/uploads/1/3/4/3/134322731/9064873.pdfIn PDF document text
    • https://xazapadikud.weebly.com/uploads/1/3/1/8/131871762/857704f7eff2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/219ba473-52dc-4f58-a25e-a7ed5e8234cd/3rd_grade_daily_language_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6385006-d3a9-4f21-ade6-30c4919fe9aa/81206691425.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e079610f-b7d2-448c-8369-4604104873c6/mewaxelevaninuto.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc57099a3bf4b14abc7ab13/t/5fc6ded3b7521d608a34cb04/1606868691441/78836610672.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1ae857d0c8f249d464d7c/t/5fcec3628b174454e98aaba1/1607385956877/paxagawiwul.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0eacbc14dfd36fef1915a/t/5fc36bfb5147b148049ec78f/1606642684106/mufogigusatomelusum.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED77 6164 bytes
SHA-256: 645f16d886c7ecc358c752a9f6872f1f21f599ea4f6285e2886108464428a19a
font_01_sfnt_off000102bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102BF 4896 bytes
SHA-256: 8d66cde3a538c108efe495b8fc9feaa62dffef3693132dab44808df5ee4fef18
font_02_sfnt_off00011365.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11365 11456 bytes
SHA-256: f2a7b49d055f435718b6ddfb643162ce98f71df36d7f80a4fc7ad8a053611dca

Open this report in the interactive analyzer, or submit your own file for analysis.