Malicious PDF — malware analysis report

Static analysis result for SHA-256 9eb13bacde1508bd…

MALICIOUS

PDF

55.4 KB Created: 2020-10-07 11:50:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 41e4f49d8002e9c4e43e6546cdc22e09 SHA-1: 7d669b4b1321167ed5e1d11d9045c82ac7a48985 SHA-256: 9eb13bacde1508bdb44f3cf58dd6aa44c477a4d0926f29bc58b2b097103da319
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying a redirector link to 'ggtraff.ru'. This suggests the document is designed to direct users to malicious infrastructure. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of malicious links indicates an attempt to compromise the user.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/pify?keyword=how+to+make+it+rain+in+minecraft+xbox+360 In PDF document text
    • http://toloz.bocesta.net/uploads/1/3/0/7/130775181/7506942.pdfIn PDF document text
    • http://files.legacy-318.com/uploads/1/3/1/4/131483488/wazuvunitemip_papajeziramoru_lisinepenof.pdfIn PDF document text
    • http://files.twotownsonebook.org/uploads/1/3/2/6/132681769/noreguxuwulala.pdfIn PDF document text
    • http://files.jilledelsteinlcsw.com/uploads/1/3/2/6/132696285/6974717.pdfIn PDF document text
    • http://files.missoryansclass.com/uploads/1/3/1/4/131437138/goxavudojopep.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/1428/1625/files/trig_formula_sheet_a_level.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0477/3294/9148/files/tekken_3_apk_obb_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/2786/9081/files/cecil_textbook_of_medicine_free_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/1617/8842/files/kelut.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/8098/1407/files/real_reading_and_writing_ebook.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009942.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9942 5604 bytes
SHA-256: a0da85b4d27220468ce37746415d7f1e6be339812fb08471cdd3232c2f30e861
font_01_sfnt_off0000ac4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAC4E 10748 bytes
SHA-256: 537591ce725dfbaf8c38f8f7ea294e9b53080c1cf91f1dba37ce17f745b2266b

Open this report in the interactive analyzer, or submit your own file for analysis.