Malicious PDF — malware analysis report

Static analysis result for SHA-256 c790fa8bae6b2d01…

MALICIOUS

PDF

53.0 KB Created: 2020-10-28 17:27:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 9f3c6c6ba24c8a1129f02e50b725a0d8 SHA-1: 8280915b838b12e6a239ea0736adcf5f4ce5e51b SHA-256: c790fa8bae6b2d015c86719f3c0d590c268a5bd7e8ca942753b14663be0b7e56
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ggtraff.ru, which is likely intended to lead the user to a phishing or malware download site. The document body, though heavily obfuscated, contains the same URL, reinforcing the malicious intent. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=panasonic+cq+df903u+wiring+diagram In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366325/normal_5f8ac086842f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393181/normal_5f8f0143a7063.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365652/normal_5f86f91d1d457.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/sinamozagemoger/61557603509.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/985b7b19-87c9-4857-bcf1-7da9246a2e3b/mercedes_benz_owners_manual_glc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aecef0f7-a2c9-4e5d-b2eb-faddc55e89a0/23197665861.pdfIn PDF document text
    • https://s3.amazonaws.com/nitirew/bioshock_rapture_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/68452777791.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1526462f-55a0-40f0-b871-12f5681f07f8/integrated_chinese_4th_edition_workbook_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/toliwudalamem/fasivobedetefavikijafi.pdfIn PDF document text
    • https://s3.amazonaws.com/guwutivupudutu/archetypal_criticism_essay.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a48c53b6-b3b1-43b9-80f2-f7e8d0542aaf/electronics_lab_manual_volume_2_ka_navas.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/diluril.pdfIn PDF document text
    • https://s3.amazonaws.com/sedimeraxufi/applications_of_column_chromatography.pdfIn PDF document text
    • https://s3.amazonaws.com/tobojelusiwi/podaxe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f28755e-11e6-4a1f-8df1-163b91154566/puritevazolisirazukuk.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/vertical_farming_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/tofizo/japudura.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007f44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F44 5676 bytes
SHA-256: ccff78a42e8605cd91ffb13cd939f3153c67e0b84c8c568b007b4d357a8ba78f
font_01_sfnt_off00009268.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9268 11212 bytes
SHA-256: f1fab40222448d0b82e8605a3a385e9c402ad3cea4cb901b46d0efae4fa41437
font_02_sfnt_off0000b83b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB83B 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.