Malicious PDF — malware analysis report

Static analysis result for SHA-256 c61204a8234adac3…

MALICIOUS

PDF

65.6 KB Created: 2020-12-13 13:17:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 545ae8e012d33eec258b518dce69f868 SHA-1: ed90eec280449632a41c98b40286353dab378b75 SHA-256: c61204a8234adac3025dc1c189c555f10d5a82b6a178f0823cb08b14ba51f0b1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating a malicious redirector link to 'https://gettraff.ru/strik?utm_term=fresco+taco+bell'. The ML classifier also flagged the document as malicious. While no scripts were explicitly extracted, the nature of the redirector suggests an attempt to lure the user to a malicious site, likely for phishing or to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8995

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=fresco+taco+bell
    • https://cdn-cms.f-static.net/uploads/4495686/normal_5fb9116b91486.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sugosubexez/quantum_numbers_worksheet_4.pdf
    • https://static1.squarespace.com/static/5fc543c640f1034a5cc59a4f/t/5fcfcb49a3f9e430eb94679e/1607453514079/41386283856.pdf
    • https://static1.squarespace.com/static/5fc10f0fab79f442f22a8155/t/5fc39299e6d49a06bb00b0bc/1606652571007/19712813776.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf61b9f81c9a2a0c99eece/1606377913541/57467509808.pdf
    • https://uploads.strikinglycdn.com/files/65452507-1ac6-4c40-af4f-74c61f4aa80c/35555950569.pdf
    • https://s3.amazonaws.com/falevi/25044261720.pdf
    • https://s3.amazonaws.com/figugipopar/double_displacement_reaction_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/438c11fb-f2f0-49fc-a53d-087f91b31e33/tolowezoxuzunuj.pdf
    • https://uploads.strikinglycdn.com/files/0e842271-2a8c-4576-b53c-0a84ea5f5490/medifidulisudeli.pdf
    • https://s3.amazonaws.com/xamapebonijos/church_of_christ_acapella_music_s.pdf
    • https://s3.amazonaws.com/vipuxafol/beylikten_devlete_osmanl_konu_anlatm.pdf
    • https://static1.squarespace.com/static/5fc52ec48ef7301f8b2ce720/t/5fcc1f3b0ab5d62febe1bcb6/1607212859745/2574260888.pdf
    • https://s3.amazonaws.com/vogubivajavofu/14808037126.pdf
    • https://static1.squarespace.com/static/5fc0d650403f5353fd956949/t/5fc0fb34f81c9a2a0cc54726/1606482741026/mifovanebituwasuxewogop.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d130.bin
b9dfbfa3932dadcfe975b0ba6464da944676c4179d598e7d8253ae3242e498a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD130 4888 bytes
font_01_sfnt_off0000e1df.bin
c14d1e4b80ce5d91dd9a59d9fdb2f139d64ca39b3923b5279761e4330cfa31c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1DF 11068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.