Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb8d39c37d403e59…

MALICIOUS

PDF

40.6 KB Created: 2020-10-30 20:25:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9793d7e4b802cc44c5352450c376ae45 SHA-1: 5469c58dc0bf14e9b848e9b6ef69a4b78fbfdbaa SHA-256: bb8d39c37d403e5906c8fc462939636d329de0fb1c82a05ff6deb82704c042f8
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF document employs social engineering tactics to trick users into clicking a malicious link. It impersonates a cloud document service and prompts the user to install a browser extension, a common lure for credential theft or malware installation. The primary malicious URL identified is https://ggtraff.ru/123?keyword=anime+google+drive, which is flagged as a redirector to known malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=anime+google+drive
    • https://wojedebaroz.weebly.com/uploads/1/3/1/6/131637691/3271694.pdf
    • https://biwugina.weebly.com/uploads/1/3/1/1/131163984/monofilejo.pdf
    • https://cdn-cms.f-static.net/uploads/4366337/normal_5f99c726a6b0e.pdf
    • https://xesaranit.weebly.com/uploads/1/3/2/6/132696194/5164149.pdf
    • https://sibakixode.weebly.com/uploads/1/3/2/8/132814768/dalorakono_jawedesalet_nekobagedi_mubutusiki.pdf
    • https://cdn-cms.f-static.net/uploads/4372707/normal_5f8a61509488c.pdf
    • https://nifubadipapa.weebly.com/uploads/1/3/4/3/134388301/04e36c.pdf
    • https://rogidalot.weebly.com/uploads/1/3/1/6/131636841/gowilopevip.pdf
    • https://xavoxoxuda.weebly.com/uploads/1/3/1/3/131379246/bedujawigo.pdf
    • https://sixodajumam.weebly.com/uploads/1/3/4/3/134311071/5d8e43ba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bajapovogam/lofivepagexesewenan.pdf
    • https://uploads.strikinglycdn.com/files/9f9e4538-54c0-447a-9b23-8349ce6de995/fanatic_sup_size_guide.pdf
    • https://uploads.strikinglycdn.com/files/24f8d2ef-447c-4e16-8acf-0b6d2f8dd546/15243438798.pdf
    • https://uploads.strikinglycdn.com/files/d6e02622-20c6-49df-9cbd-b463ed841aa5/18447252989.pdf
    • https://uploads.strikinglycdn.com/files/9a97302f-b3a5-46b5-bd1d-3abe6fab4810/74562005397.pdf
    • https://s3.amazonaws.com/desenaz/gojisenapukiwe.pdf
    • https://uploads.strikinglycdn.com/files/c447b86e-d393-452d-9e82-778a045c2c88/tukezibad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000630e.bin
15983dab332adcbe4a1904a9c6a8e8ac438a303baca02a3d1b375755f8301bea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x630E 4808 bytes
font_01_sfnt_off00007358.bin
72bf81328420f232f72730124921f87fd21eac9090d5cb04359988f8c9a70503		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7358 10048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.