Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8bf2c1373773886…

MALICIOUS

PDF

73.2 KB Created: 2020-11-18 22:20:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 78014082fe07f164bd853597d195329b SHA-1: d835e16c8e5f6e61c35a2cc7115a1bfa12dd0b53 SHA-256: a8bf2c13737738866c99482fe0c005db2346520b632fe2100fe6dd5c8abfb0e0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://traffine.ru/strik?utm_term=shadowrun+arsenal+2060'. This indicates the document's primary purpose is to lure the user to this external site. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of a malicious URL is sufficient evidence for a phishing or malware distribution attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=shadowrun+arsenal+2060 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4414848/normal_5f9be984eb7f2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454301/normal_5fb5698e8bcfa.pdfIn PDF document text
    • https://folatidaxewurel.weebly.com/uploads/1/3/4/3/134317863/26a5d06663686.pdfIn PDF document text
    • https://fovokifijinibe.weebly.com/uploads/1/3/4/5/134582558/vexulujode.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372086/normal_5fab5371cb8e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451949/normal_5fa0d0e07f99e.pdfIn PDF document text
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/aa94aa7f99c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457838/normal_5fa5036beb94b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384460/normal_5f99c8e79dec8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422372/normal_5f9a05ebbd731.pdfIn PDF document text
    • https://bopiwode.weebly.com/uploads/1/3/4/3/134367631/9511470.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/c0e58130-2c0d-47b5-9930-086c53de59ef/42184623936.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f77f8abd-04db-4be3-97de-5bb0f8b212ac/density_worksheet_with_answer_key_chemistry.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be4b9958-ef0c-445a-8a14-9499d0c2c5f4/go_math_lesson_11.3_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0D9 5288 bytes
SHA-256: 2056749a491cd9d12b97942760f26dec4bcf165b6da2472ac86ab8f53dbbed36
font_01_sfnt_off0000e2c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2C3 11744 bytes
SHA-256: a301f92068cbe8b38df4811b3e106dcf6f34839bfad4ef873c95c235d08a3544
font_02_sfnt_off00010a0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A0E 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.