Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2f4be7666817597…

MALICIOUS

PDF

104.8 KB Created: 2020-12-30 07:47:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: be268bc4ecbdb3a778b7ebf9b9ff25a0 SHA-1: 15dcafaa2de5b7124d7219da743c1f5bd7bddfe7 SHA-256: b2f4be76668175974cfc62839d69b4b9ac99da7026f2520f0989f91d1216d6cf
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ggtraff.ru'. Additional heuristics indicate the document uses lures common in phishing and callback scams, such as instructing the user to scan a QR code or call a phone number. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of a malicious URL is a strong indicator of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=huawei+ascend+xt In PDF document text
    • https://cdn-cms.f-static.net/uploads/4385852/normal_5fe66213c9161.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414860/normal_5fdc0403ab118.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417327/normal_5fec0ef240009.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff4d8bd5-5f0d-41b2-86cb-a82dd833d1f0/suvararolobozovexoro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c8767e3-f3d8-4d23-942f-17726645c6e2/71416738326.pdfIn PDF document text
    • https://s3.amazonaws.com/janodojivi/hindu_baby_girl_names_in_kannada.pdfIn PDF document text
    • https://s3.amazonaws.com/jirebonudur/pejefumedopibowikedewesus.pdfIn PDF document text
    • https://s3.amazonaws.com/bulikowexunepov/26843383125.pdfIn PDF document text
    • https://s3.amazonaws.com/gifojuxaxeva/1370283514.pdfIn PDF document text
    • https://s3.amazonaws.com/sugowubuf/kevogadam.pdfIn PDF document text
    • https://s3.amazonaws.com/wexukufedepim/zoe_pound_hipwiki.pdfIn PDF document text
    • https://s3.amazonaws.com/rufonali/84115824313.pdfIn PDF document text
    • https://s3.amazonaws.com/debiwelof/84744426740.pdfIn PDF document text
    • https://s3.amazonaws.com/bisapovepizaj/dagenimake.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013cb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CB8 3024 bytes
SHA-256: d51082e38e264068454af3c8ff3847f786d19fce9ce0fd6a17743c0e77d0e17b
font_01_sfnt_off00014787.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14787 4928 bytes
SHA-256: c2906593e7edeaa83c5d13b3ea500cae2497210b764613b64cbf178ca5cd8cf4
font_02_sfnt_off00015872.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15872 11968 bytes
SHA-256: 4dcad0626eafde109f82ce05ef4b76e6a2700b45194d0172c7e4f5704bcd5633
font_03_sfnt_off000180da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x180DA 16076 bytes
SHA-256: 77d0e41b193f2956426f125f137c5665e22c2099967b8d3a504bff5b234847bc

Open this report in the interactive analyzer, or submit your own file for analysis.