Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a299cdec84d643a…

MALICIOUS

PDF

34.7 KB Created: 2020-11-02 16:17:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8ffa23e61b45277160a35d80cd638df5 SHA-1: e60ed5a6053ae24237869d07d8b7c380ddd249f0 SHA-256: 8a299cdec84d643a17e34c76765f8a0046ef0c3a1c31f2583494d9b90c058f01
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, with 18 identified as generated SEO links. One critical heuristic firing indicates a link to known malicious redirector infrastructure at 'https://ggtraff.ru/aws?keyword=veritas+cluster+manager+-+java+console'. This suggests the document is part of a link farm or SEO manipulation scheme, potentially leading users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=veritas+cluster+manager+-+java+console
    • https://cdn-cms.f-static.net/uploads/4366343/normal_5f89b5a993b0c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0431/7587/0630/files/granite_city_tool_rental.pdf
    • https://cdn.shopify.com/s/files/1/0483/9908/9824/files/hemnes_dresser_instructions_3_drawer.pdf
    • https://cdn.shopify.com/s/files/1/0503/3322/1027/files/avast_antivirus_gratuit_pour_tablette_android.pdf
    • https://cdn.shopify.com/s/files/1/0507/1857/2704/files/guzujidesakavedumet.pdf
    • https://cdn.shopify.com/s/files/1/0506/9783/0554/files/gajaledivoposaz.pdf
    • https://cdn.shopify.com/s/files/1/0478/9957/4438/files/rugagewidaraxi.pdf
    • https://cdn.shopify.com/s/files/1/0501/5568/4002/files/elodie_details_ciapka_bazar.pdf
    • https://cdn.shopify.com/s/files/1/0496/5321/9479/files/gapeduxin.pdf
    • https://cdn.shopify.com/s/files/1/0504/2012/1760/files/venoj.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000599b.bin
dcfb46d87291db2435a71d817758113f34d7303d27cc2ca419774f695e2014e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x599B 5252 bytes
font_01_sfnt_off00006b71.bin
d8848e00b46f65bc9a9a3f4731fa6fdc042303b6270c7d441b6233f16714367e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B71 10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.