Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5bdfc9f890978de…

MALICIOUS

PDF

47.5 KB Created: 2020-10-30 21:09:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4b8ff4965c09e6a9cc739ee9d9b0dfca SHA-1: 7e98673916e382fc6b6447da54447c6e5cc89faa SHA-256: a5bdfc9f890978dea48a767625840260ecb4c277e0b8985e07488b49e5e18bc4
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://gettraff.ru/strik?keyword=ssu+apk+uptodown'. The ML classifier also flagged this PDF with high confidence. While no scripts were extracted, the embedded URL is the primary indicator of malicious intent, likely serving as a lure to download additional malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=ssu+apk+uptodown
    • https://cdn-cms.f-static.net/uploads/4412408/normal_5f9648ee84510.pdf
    • https://cdn-cms.f-static.net/uploads/4418379/normal_5f99e9632ee1a.pdf
    • https://cdn-cms.f-static.net/uploads/4370066/normal_5f93349e2e1c0.pdf
    • https://cdn-cms.f-static.net/uploads/4403676/normal_5f945f59a59a3.pdf
    • https://cdn-cms.f-static.net/uploads/4379849/normal_5f8f28bc5de11.pdf
    • https://cdn-cms.f-static.net/uploads/4405925/normal_5f92c41fba251.pdf
    • https://cdn-cms.f-static.net/uploads/4376849/normal_5f9342d57393d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zetare/bosch_pneumatic_cylinder.pdf
    • https://uploads.strikinglycdn.com/files/ff53f64a-532c-4fee-b6f6-9d2189ae7db5/40333165976.pdf
    • https://uploads.strikinglycdn.com/files/6a893a10-01c4-472d-aaf5-a882313aec54/eudicot_vs_monocot.pdf
    • https://cdn.shopify.com/s/files/1/0268/8771/7035/files/pes_club_manager_2020_apkpure.pdf
    • https://s3.amazonaws.com/nuxepiduded/berserker_pvp_guide_bdo.pdf
    • https://uploads.strikinglycdn.com/files/f451e7cf-efba-44cb-b3b2-5fba0da3b2bd/paul_senior_orange_county_choppers_death.pdf
    • https://cdn.shopify.com/s/files/1/0430/3588/5721/files/tadowijexuzerelu.pdf
    • https://cdn.shopify.com/s/files/1/0433/2306/4488/files/upgrade_huawei_p8_lite_to_android_6.pdf
    • https://cdn.shopify.com/s/files/1/0484/6790/2626/files/cambridge_paver_installation_guide.pdf
    • https://uploads.strikinglycdn.com/files/9bcf5435-49ed-4172-8cc0-d46fd6ac0606/xebufisulaxukilesewofa.pdf
    • https://uploads.strikinglycdn.com/files/bd069755-c296-4703-986b-5eee86738e94/xanonimapumesuv.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a14.bin
8ca4f71c2c06eb2f7c4a94296badd282176d88f152ed81cc7abc63a2a2c15f35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A14 5084 bytes
font_01_sfnt_off00006b81.bin
9ee7db78a680e954fc83827cb3b0ef6d483254f0c29ad6cde1ee3630ce45ecab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B81 2904 bytes
font_02_sfnt_off00007774.bin
b211ec25fe6543c2c639a0bfa11590a609d86918f73f2afa11381e8302ef7fe6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7774 10552 bytes
font_03_sfnt_off00009bc6.bin
b118ad4a5f0f66e944d0a6e82a0dad6050c27e77cb1eabf64d07f40874ae21b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BC6 16080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.