Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3d8a980106da24d…

MALICIOUS

PDF

47.5 KB Created: 2020-10-28 14:55:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 83684296fe182b4306de9fb16cdc509e SHA-1: 485b8b5ca14781e9b7a17c24db098bbcb32aeaee SHA-256: b3d8a980106da24dc302cca332a3e9e2ade7d45d298dc470779b9565ca1964b3
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://gettraff.ru/strik?keyword=the+snake+goddess'. The ML classifier also flagged this PDF as malicious with a high probability. The document body, though heavily obfuscated, contains the same URL, suggesting it's the primary mechanism for luring the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=the+snake+goddess In PDF document text
    • https://cdn-cms.f-static.net/uploads/4426090/normal_5f9780f68cc9e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370542/normal_5f94f2b297417.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376856/normal_5f8a186a866a3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/2fb5e69c-f99d-4dcb-bacb-73d5465da5a5/38956039888.pdfIn PDF document text
    • https://s3.amazonaws.com/ropuba/72911721597.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e7c0c1c-54c7-4a62-9d2e-0525d4cdfd0f/86807225417.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78ab27b9-fbc5-4e0f-bd3c-49f92f50edf2/seniguxus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98c0d302-0c19-47d4-b7dd-bc3e335a39b4/bumumeduloxaw.pdfIn PDF document text
    • https://s3.amazonaws.com/sugaguxagu/populenod.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c17d9a6-249f-4ed7-9233-82c2feff6c0e/winter_garden_book_spoiler.pdfIn PDF document text
    • https://s3.amazonaws.com/leguvefu/action_research_in_english_sample.pdfIn PDF document text
    • https://s3.amazonaws.com/sugaguxagu/40526028769.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/105432d6-392c-4367-99a6-52ee9e73dc2e/wetosaxuf.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/sufugamokaronel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9aeb56b8-2556-4a86-95db-166ea233ef39/gezebesazoraluderow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a2304eb-62d6-434c-a60e-23ac7dbd3d1e/2229309118.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d930930-16ee-434b-b32e-8c4cf0651e61/broadcasting_script_english_showbiz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c42bfe6f-9fe4-436d-9a8d-0219dd126319/vopejununusozozexuwodedut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de11e12c-782f-4946-95fb-3c7ef54a0ebf/76646821701.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F18 4632 bytes
SHA-256: c6992115e89a21020f2837557538dd3be3f99f5d478e1a67e744685e611bd34f
font_01_sfnt_off00007ebf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EBF 10540 bytes
SHA-256: 771a80060cadb664685fd1b4e305d50bf1bfad12fb23b237e128d3d6a71cb31c
font_02_sfnt_off0000a28d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA28D 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.