Malicious PDF — malware analysis report

Static analysis result for SHA-256 95eedb5c4c897ec3…

MALICIOUS

PDF

37.5 KB Created: 2020-10-05 10:49:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 9f8a42964d4d1def09c9abc621b26cac SHA-1: f213659014219199abe03a5e897df777ddb0f5f3 SHA-256: 95eedb5c4c897ec3fd2cacde2832827491d83cf2480f1a7871273fa4e7f5c54b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, https://gettraff.ru/strik?keyword=war+of+the+spider+queen, is the primary indicator of malicious intent. While no scripts were extracted, the PDF structure and the malicious URL strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=war+of+the+spider+queen In PDF document text
    • http://files.mwmresearchgroup.org/uploads/1/3/0/7/130739557/jekitebi.pdfIn PDF document text
    • http://jolusibam.rivercitygivers.com/uploads/1/3/0/8/130874388/b3ea954e2.pdfIn PDF document text
    • http://files.abwahawaii.org/uploads/1/3/1/4/131453408/gunovigenudogifalav.pdfIn PDF document text
    • http://marobogum.flowinfrastructure.com/uploads/1/3/0/7/130740292/gotuzatulo-jigazovekizud-kepojemozuwiwus-dekawakewa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/01617fd4-cabd-4501-a57a-07c60898883c/92423035108.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5b2e71d-9a68-48fe-acb1-55878dd0375e/gezolijekisupide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/451ed58e-8a7d-41c4-9281-38ff94a5ed61/79847030355.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19731e64-bd3f-451a-be8a-25f966270830/zawudegalibed.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/1045/6726/files/2013_nissan_altima_repair_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/6200/1301/files/osrs_slayer_tower_cannon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7ef4d5d-a84e-4082-8721-4218f33eadd4/2327528819.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1f07230-2aab-45c6-800d-fbcfd316f51d/danojopofafu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f912addb-1eed-4433-a717-25441b37c453/vuvasuwodedor.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005577.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5577 5236 bytes
SHA-256: 4948395ca488eb3e1cf1089d7cccf2f77c696f8c5acee8866a7c6180546bcdb2
font_01_sfnt_off00006750.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6750 9964 bytes
SHA-256: d888363aba7716aed93491acc4426e6c45548f96b0abd291029ea2ed4aef588c

Open this report in the interactive analyzer, or submit your own file for analysis.