Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ba4e7d7a454b22d…

MALICIOUS

PDF

73.1 KB Created: 2021-01-09 04:20:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 9cd4e69cdcf238aba580a464f338d5ca SHA-1: ee0410b950602031f449620b28794dfbefc1620f SHA-256: 9ba4e7d7a454b22dc5ee96d6ba52ce524b00e9d7f8406ff411c80993df4cddeb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating a malicious redirector link to 'https://gettraff.ru/123?utm_term=little+red+sled+book'. This URL is the primary indicator of malicious intent, likely serving as a lure for phishing or to download a secondary payload. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?utm_term=little+red+sled+book In PDF document text
    • https://cdn.sqhk.co/suwapipejob/fCghDic/endless_prince_run_in_forest.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a809efe-ce3c-419e-b439-f5db5ec62b1d/vodumowupanijugitun.pdfIn PDF document text
    • https://s3.amazonaws.com/legesiliv/32546603601.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fef9b39-f783-4b7a-97d6-1749f5c00aa8/pathfinder_combat_expertise_trait.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94f82d4e-bdc2-4c7a-b085-2d3ad230b6f2/battle_disc_hack_mod_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/598b26c5-89e4-4766-b8f2-d22702c4992a/waddell_language_academy_school_supply_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6fc596b-18fd-452c-8e7f-c01826638b9d/93296707435.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6b0ed1c-24c3-4ee8-91e3-f0bbd544a7a2/dimensional_slide_pathfinder.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00f57036-9348-4752-babc-4ca0fcad1cd1/fafomalazenarijej.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21eb67bb-3bd9-43b3-9f7d-5e0efdf1840e/saxop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eef82328-509e-44ff-a920-29962a92bfc1/jepobaz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a55d1cf-01a3-40a6-a641-e0c0fc87c1eb/minecraft_teleport_to_coordinates_command_block.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1E5 4756 bytes
SHA-256: 671698950ceeef46e2e23dafee3f26a10ee07e7d7d012291c010cb73aa0ec2e2
font_01_sfnt_off0000f21d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF21D 10484 bytes
SHA-256: 648937c79c53d5ce3d16dec9bdee3246d087157ae54a3d7a80c872ea9e92f77f

Open this report in the interactive analyzer, or submit your own file for analysis.