Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab38a628bc3f92a1…

MALICIOUS

PDF

44.2 KB Created: 2020-11-04 14:46:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 72054332fecb470099cf43207e89c35d SHA-1: 884ed8402e343f803794ac3cc86fa9b8fad5ee4e SHA-256: ab38a628bc3f92a11909e3f035ca7454333eb2c38fe694ae64811ad7f7561389
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://ttraff.link/123?keyword=the+handbook+of+nonprescription+drugs+pdf', is the primary indicator of malicious intent. While no scripts were extracted, the presence of a malicious link within the document body strongly suggests a phishing or redirection attack, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/123?keyword=the+handbook+of+nonprescription+drugs+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4370080/normal_5f9121e31240f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375909/normal_5f9d4d59a2619.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390995/normal_5f9653c374d26.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367905/normal_5f920984cff29.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387922/normal_5f95f739193a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379486/normal_5f9264bf1a5e0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418993/normal_5fa11da757cc5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/desenaz/c_s_lewis_quotes_on_pain.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72e9f3d7-243b-43f7-b1a8-40d08ec4e369/babugos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c84945c-2bc1-4831-81fa-d5080ab3438e/what_is_crc_cards_in_uml.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ec38ab4-df7e-4ab6-9045-f299b3d0144a/xizisuwitopiliwodufukapat.pdfIn PDF document text
    • https://s3.amazonaws.com/fojaxexino/fusionner_plusieurs_fichiers_dans_un_mme_gratuit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d130be5-f738-44a3-af40-cafc270d4837/rumedovulevagaluzinaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/248ec808-a87f-45b5-8270-4d29d5dd1488/1251422812.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a9360ea-7931-41f9-8ae1-4b37b9ceebb0/wobojeparasapusetakarixo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7c2fb73-64d6-452d-95b4-772b0427336a/double_bubble_thinking_map_template_printable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3ee44df-c789-472b-95f6-973486ee969e/34975654968.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F95 5420 bytes
SHA-256: 7aa3c1841a057b46d4c47ad58b3eac5f7bc77c58d5961430a5f1940e7f1b7f95
font_01_sfnt_off000071f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71F2 10520 bytes
SHA-256: c0fab8e6116034cda81c0aa1df6fed1c2c600eb45edbbceca17e1141d24b223b
font_02_sfnt_off00009586.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9586 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.