Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b9d7be8645d9b8d…

MALICIOUS

PDF

55.3 KB Created: 2020-11-08 00:19:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: ef22ec0b2e568e57d1ea1df781fc7929 SHA-1: 18b6b27ba1b2bd6e48ae6e54402071258ab1d518 SHA-256: 9b9d7be8645d9b8d2d6cc02810ec60bd48816ef60a069e739047c3a0c24e7c4c
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded text and a URL that mimics a product manual, likely to trick users into clicking the malicious link. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' confirms that the embedded URL, https://gettraff.ru/aws?keyword=sony+dvd+blu+ray+player+manual, leads to known malicious infrastructure. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=sony+dvd+blu+ray+player+manual In PDF document text
    • https://cdn-cms.f-static.net/uploads/4370066/normal_5f923da52c32f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375083/normal_5f93ae4722f98.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c45c41ad-4112-4317-9ad3-f5a9d148d092/accord_and_satisfaction_defense.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d296d172-3dcb-4dbe-b551-5460840c3deb/sylvia_the_play_youtube.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f96924b-68d5-4661-aa3c-6dbdbf8a7a3a/gewusitolen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/518140b5-e01c-43c9-9464-ca4b7f382208/73158667072.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edd24c51-fb0d-41b4-8e4c-f16c7f809ef6/vewuxamizoxasolasiluni.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7488f1b-105d-4699-a664-9942d79b8f80/81643117588.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a056f99e-95b7-4eac-b0c8-6d0b3d70ef81/63023790279.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50faaa70-4463-475d-9146-12f8a1dfc2c3/pufivojul.pdfIn PDF document text
    • https://s3.amazonaws.com/kofabube/39250812181.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25910a15-c8ab-4215-a1c0-406450b280a4/pifapadutumelusudomer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0489bcf-7b0d-4cd2-aa6c-8ecc1e1d81e0/17755916816.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ecff6c1-5b65-48f6-b7f8-c3136fd3d295/minecraft_sweet_and_awesome_1.5.2_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008333.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8333 5332 bytes
SHA-256: 177a8faf1c802bf1ba2460f84ff9c6fb9b5d4e7f40f93f3e58e39e3e4c1c00b3
font_01_sfnt_off00009549.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9549 10572 bytes
SHA-256: 9fe0f0016773e9791585d882fe7dcf577dde62a848f785154688310861bf0264
font_02_sfnt_off0000b976.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB976 16448 bytes
SHA-256: 4d0b7fceb6e0b8544dba10d314310d86ee7e0ac375a8e3b5fd915ca5fa71995c

Open this report in the interactive analyzer, or submit your own file for analysis.