Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7897217dae0bdb6…

MALICIOUS

PDF

69.6 KB Created: 2020-11-01 03:04:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c44c45434595ecda205a0418abeb014 SHA-1: 41fd32b5da261497139e4a2c9aaf496b30bd9870 SHA-256: a7897217dae0bdb64c346c3b58b81ca7f51e5337fb14cc7264327b02c9ae5984
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ggtraff.ru/strik?keyword=the+divine+comedy+summary+pdf'. The document body, though heavily obfuscated, also contains this URL. This indicates the primary purpose is to lure the user to a malicious site, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=the+divine+comedy+summary+pdf
    • https://cdn-cms.f-static.net/uploads/4387716/normal_5f967b00870a7.pdf
    • https://cdn-cms.f-static.net/uploads/4372100/normal_5f8cbf6d38947.pdf
    • https://cdn-cms.f-static.net/uploads/4426690/normal_5f99aae6549d2.pdf
    • https://talapilodegopez.weebly.com/uploads/1/3/0/9/130969507/c75b2532f.pdf
    • https://cdn-cms.f-static.net/uploads/4417216/normal_5f97af4c12cb1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0e52bd0d-dd67-4172-b1c9-288b560bba3d/modelo_faria_mello.pdf
    • https://uploads.strikinglycdn.com/files/8144e30f-a973-4f53-bf35-f061a41f6341/notice_ampli_yamaha_htr_6040.pdf
    • https://uploads.strikinglycdn.com/files/f67ac677-18e9-406f-89a7-8be9ff6d56f6/41626049909.pdf
    • https://s3.amazonaws.com/fotojipifuzitul/89470617512.pdf
    • https://uploads.strikinglycdn.com/files/7ee23b12-23e8-452b-8024-a7203b853622/mimomavipazojobu.pdf
    • https://cdn.shopify.com/s/files/1/0266/9363/2190/files/31924091134.pdf
    • https://uploads.strikinglycdn.com/files/0f01f6ff-1b11-4768-9ed5-7aef178ae8d4/72194889019.pdf
    • https://cdn.shopify.com/s/files/1/0494/1987/8567/files/kovoperegigalisuk.pdf
    • https://s3.amazonaws.com/bidurudilidujug/zaraguropojibatamimi.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff73.bin
ad709dfc5164a82df98f2da17c769d5149ebb12ed97aaabf6ce59d1182d9a328		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF73 5472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.