Malicious PDF — malware analysis report

Static analysis result for SHA-256 be3096bcfa1162be…

MALICIOUS

PDF

24.6 KB Created: 2020-11-05 03:55:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 779771aaf1b184c367858a9e747a3943 SHA-1: 00120b5237900e82bd14b862bb2a8c4f84e06cff SHA-256: be3096bcfa1162be47e261e483235c6802707739d822f800730270b372522c64
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing for a malicious redirector link, pointing to a URL that is likely part of a phishing or malware distribution chain. The embedded URL, 'https://gettraff.ru/strik?keyword=liberty+university+college+for+a+weekend+2020', is the primary indicator of malicious intent. While no scripts were extracted, the PDF structure and the malicious URL suggest an attempt to redirect the user to a compromised or malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=liberty+university+college+for+a+weekend+2020
    • https://cdn-cms.f-static.net/uploads/4381740/normal_5f93d8147817a.pdf
    • https://uploads.strikinglycdn.com/files/2db5dd63-9511-470e-a595-b7dad57142a2/act_1_the_crucible_answers.pdf
    • https://s3.amazonaws.com/wopari/9525794290.pdf
    • https://s3.amazonaws.com/bakoloj/67574304144.pdf
    • https://s3.amazonaws.com/sisaxu/the_last_stand_union_city_download_full.pdf
    • https://uploads.strikinglycdn.com/files/288d644f-d2c0-4310-b480-e1a0ba85eb8c/39257312177.pdf
    • https://s3.amazonaws.com/zedudo/75809257994.pdf
    • https://s3.amazonaws.com/mizeteb/buzetagolelebirapevifirax.pdf
    • https://s3.amazonaws.com/wikurixobelu/46840104228.pdf
    • https://s3.amazonaws.com/lewuli/past_simple_regular_and_irregular_verbs_exercise.pdf
    • https://s3.amazonaws.com/zuguvoxoki/al_anon_bookstore.pdf
    • https://uploads.strikinglycdn.com/files/8f6cc916-9899-49a6-aa9e-d57873aa4571/37070761715.pdf