Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bd0fcac674af508…

MALICIOUS

PDF

108.9 KB Created: 2020-12-30 17:24:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3859fb2fe150d1a689a2c0eed8d35bd1 SHA-1: d5347f86ca19de8cf4ccd5ce784e08af112efd2f SHA-256: 8bd0fcac674af508a3eb37c3c47d3c5b49c0a4d3df70056cfb99d09da87d5344
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ggtraff.ru'. This URL is likely used to deliver a secondary payload or phish for credentials. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the embedded URL is sufficient evidence of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?utm_term=south+korean+light+attack+helicopter
    • https://cdn-cms.f-static.net/uploads/4403948/normal_5fdc12d15c205.pdf
    • https://cdn-cms.f-static.net/uploads/4406516/normal_5f9d8caa9840a.pdf
    • https://cdn.sqhk.co/numanazolov/NhhWria/roraxe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fosalizuzu/jezufunonideja.pdf
    • https://uploads.strikinglycdn.com/files/7c162993-f813-451c-9b4c-c526fb97e236/26737717250.pdf
    • https://uploads.strikinglycdn.com/files/3f96d051-2c3d-4a06-9022-8bed26d0fe3c/itube_download_apk_2.6.pdf
    • https://uploads.strikinglycdn.com/files/b78f9279-3887-4069-b9fd-54d3299db399/this_test_detects_starch_in_solution.pdf
    • https://s3.amazonaws.com/labitajaxatufib/quick_fire_pool_85.pdf
    • https://s3.amazonaws.com/jixerubowi/jarrod_radnich_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/3d50eddc-714e-464f-b35f-ca7af34b6e4d/tamigiriravox.pdf
    • https://s3.amazonaws.com/wiwuxot/google_docs_page_break.pdf
    • https://uploads.strikinglycdn.com/files/9c635d30-9e1d-4310-835a-5f51366d2fee/jujivebesexowixidulagim.pdf
    • https://s3.amazonaws.com/virumutipalis/romiette_and_julio_summary_chapter_10.pdf
    • https://uploads.strikinglycdn.com/files/58716460-a9e3-4bae-b787-e81625245b36/zusoxukumiv.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00017a8f.bin
b75a350752525bf4cf5ec05270193912a8793457fee86f22b5182e72d2055094		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x17A8F 24360 bytes
font_00_sfnt_off000122c4.bin
e60292c08ccbc7adb3656e913359d69522608f55e6639b76b78f501072bb6e5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122C4 9968 bytes
font_01_sfnt_off0001428a.bin
f39b9fd67cfddccc0aecc60946498cf05114e7ad8091b0b79f5ad589ee21c39e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1428A 5184 bytes
font_02_sfnt_off0001542b.bin
d76521cbf07b866f95fc8dabd69372e175d55e678f4f99148849bfc62dbb713c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1542B 11128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.