Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf82760864c391c2…

MALICIOUS

PDF

35.6 KB Created: 2020-11-01 06:12:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24c8f57b1dbfd2f57ab2e75a5e5a02e8 SHA-1: 45e2f8bbe7aa31f46cc35077b12c25b370856508 SHA-256: cf82760864c391c2d80a9b6bdca84a0d5892991ac4d97ef5170b2cf6185b79c5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://gettraff.ru/aws?keyword=garcinia+cambogia+select' is confirmed as malicious. While no scripts were extracted, the presence of a malicious redirector strongly suggests a phishing or scam attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=garcinia+cambogia+select
    • https://voletiga.weebly.com/uploads/1/3/4/5/134501602/gotiraxadoburu.pdf
    • https://razixolinatu.weebly.com/uploads/1/3/4/3/134384461/6540813.pdf
    • https://finazodaxuvoj.weebly.com/uploads/1/3/2/6/132682535/1535740.pdf
    • https://lezunodukulo.weebly.com/uploads/1/3/4/3/134341823/xiwujabogikawi_pojepiwopiva.pdf
    • https://gamupizesusaza.weebly.com/uploads/1/3/1/3/131398140/nabomet.pdf
    • https://movulejovem.weebly.com/uploads/1/3/4/4/134470355/ninawedaxakiwejugon.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/nidisetati.pdf
    • https://moxitimufetumo.weebly.com/uploads/1/3/4/0/134040580/pisogajoxiti.pdf
    • https://cdn-cms.f-static.net/uploads/4415300/normal_5f9bf3735ffc9.pdf
    • https://latenenagizogip.weebly.com/uploads/1/3/2/6/132696064/1762452.pdf
    • https://cdn-cms.f-static.net/uploads/4412767/normal_5f995d30df389.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wepeliniru/what_are_the_goals_of_psychology.pdf
    • https://uploads.strikinglycdn.com/files/89165231-375e-43d2-8990-45a7a886c2fb/muzisuwedisi.pdf
    • https://uploads.strikinglycdn.com/files/2b5a126a-9cc5-4e70-b535-fc3bd5a92963/.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b27.bin
870808caef29269e25c7f9c1b490874fc5140a819ab020af30085556c376f5a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B27 5292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.