Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7b0eeaf1b1f52f3…

MALICIOUS

PDF

16.6 KB Created: 2020-11-03 11:21:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4223a9d74885cb6b7567723dcb33f256 SHA-1: f402035fd62d4a319098f1c14ab00824d63e8dac SHA-256: b7b0eeaf1b1f52f3e614d42c158c7c71bfc0dd758e0ede5224ab5b41aeeaa35f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document that contains an embedded URL pointing to a known malicious redirector. The ML classifier also flagged this PDF with high confidence. The embedded URL, https://ggtraff.ru/aws?keyword=last+trumpet+ministries.org, is the primary indicator of malicious intent, likely serving as a lure to a further malicious resource. No scripts were extracted, but the presence of a malicious redirector is sufficient to classify this as a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=last+trumpet+ministries.org
    • https://cdn-cms.f-static.net/uploads/4369173/normal_5f9e51b9a3e70.pdf
    • https://cdn-cms.f-static.net/uploads/4414672/normal_5f9d6cfb385b6.pdf
    • https://s3.amazonaws.com/zunewidimem/pefanipabivo.pdf
    • https://s3.amazonaws.com/wapabefizosumi/the_most_dangerous_game_general_zaroff_character_traits.pdf
    • https://s3.amazonaws.com/liwelu/koine_greek_pronunciation_audio.pdf
    • https://s3.amazonaws.com/xanebavifamopez/tagagevawagerabekakobez.pdf
    • https://s3.amazonaws.com/levovod/ekart_logistics_franchise_guide.pdf
    • https://s3.amazonaws.com/zobuwubedak/69079864846.pdf
    • https://uploads.strikinglycdn.com/files/635e408a-6718-4c26-a4c9-71331d9902ae/xagolomatuminazozakamefe.pdf
    • https://s3.amazonaws.com/bewibiwat/fnaf_5_mod_apk_download.pdf
    • https://uploads.strikinglycdn.com/files/91e48462-978c-43f7-b693-91caab567f4c/25862296458.pdf