Malicious PDF — malware analysis report

Static analysis result for SHA-256 b40942f615e15c03…

MALICIOUS

PDF

49.6 KB Created: 2020-11-24 23:33:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 113e5b84e809661035c7fb3d0c8bcb3b SHA-1: 2b699003984be98b44b0074a5771bcb5edf95ab4 SHA-256: b40942f615e15c03095006c4ca5cc9dea9061cb1cc7db561d1ff8cb247973f30
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical alert for a malicious redirector link and a high ML score. The embedded URL, 'https://ggtraff.ru/aws?utm_term=cobbler%2527+s+bench+guide', is identified as a malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for the malicious link. No scripts were extracted, but the presence of a malicious redirector strongly suggests an attempt to lead the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9589

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=cobbler%2527+s+bench+guide
    • https://nukubutoti.weebly.com/uploads/1/3/2/3/132302768/5378404.pdf
    • https://cdn-cms.f-static.net/uploads/4470972/normal_5fb71a54bf2f6.pdf
    • https://cdn-cms.f-static.net/uploads/4447258/normal_5fabdc00cee5f.pdf
    • https://cdn-cms.f-static.net/uploads/4467564/normal_5fad579969a55.pdf
    • https://gogozugibijom.weebly.com/uploads/1/3/4/3/134369614/dadakab-lulazirapofal-wegola.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lupuvogotog/rawupiregeniwe.pdf
    • https://uploads.strikinglycdn.com/files/96ae2e35-8b96-4520-8106-885c2c1c6bd7/dd.pdf
    • https://uploads.strikinglycdn.com/files/7a651f0a-fc53-4f40-a340-f0ab4b9a4051/91377094412.pdf
    • https://uploads.strikinglycdn.com/files/39430fb8-8f00-4d70-ac09-14a9863c3352/como_tomar_posse_da_beno_download.pdf
    • https://s3.amazonaws.com/xojafemori/roland_sc-88_soundfont.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a98c.bin
02ad9c212e49ca41734f5cd4f0318dfd0eb822ac747cbe3c71376d0e65f78227		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA98C 5072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.