Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7e29414e5c9113d…

MALICIOUS

PDF

600.3 KB Created: 2020-12-10 00:30:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-03
MD5: 2aff2874ae8cb56f1cd28c0b6aceb9ad SHA-1: 9c0a969f506a01b3e2e463dc1a877dad09942671 SHA-256: a7e29414e5c9113d4228ab50c040bedcef215e49435b13aa43b9b8d778bc2766
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic firing indicating a malicious redirector link to 'https://gettraff.ru/wb?keyword=bandook%20ki%20image'. This suggests the document is designed to lure users to a malicious site. While no scripts were explicitly extracted, the PDF structure and the presence of embedded URLs strongly imply an attempt to exploit users via a malicious link, aligning with phishing or malware delivery tactics.

Machine Learning

  • Nyx PDF Classifier clean score 0.1784

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/wb?keyword=bandook%20ki%20image In PDF document text
    • https://cdn-cms.f-static.net/uploads/4367017/normal_5f8d22e4efba5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393752/normal_5f9c3bc79fc2f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448094/normal_5fa901c9f3f65.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483589/normal_5fba1a4715665.pdfIn PDF document text
    • https://samomalekadoj.weebly.com/uploads/1/3/1/4/131438786/melukijajaxegirozemi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456387/normal_5fa89f56eb2a1.pdfIn PDF document text
    • https://tanaxigurav.weebly.com/uploads/1/3/4/2/134266775/denesanijibep.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc1d0d6bd14ff0dd2a325bf/t/5fce814604f408522dc36bd7/1607369030039/11814562564.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fa7c184-3f64-4c76-af13-de2ee24bd389/82659651891.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7ace30f-331f-4f94-ade9-747f1c402f8a/48313076957.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc149a6a3bf4b14ababd147/t/5fc51c9d5147b14804d57807/1606753437076/43824989057.pdfIn PDF document text
    • https://s3.amazonaws.com/redegelesibif/macbeth_guided_reading_questions_act_1.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00091f6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91F6D 4952 bytes
SHA-256: c65071da04b92cbb2b899ef4aec513976fb4892acec2898fca0439d68f21ca4c
font_01_sfnt_off00093047.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93047 14328 bytes
SHA-256: 95d0e19e7e22bfbbb651b8357334879781f7a77232ca0f5a6260572ad38b984e

Open this report in the interactive analyzer, or submit your own file for analysis.