Malicious PDF — malware analysis report

Static analysis result for SHA-256 d650ae877c815d0b…

MALICIOUS

PDF

38.7 KB Created: 2020-11-04 00:54:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 3a0900de9be6f391e014689a60379b98 SHA-1: 8feb85825bc8e0f7d5d40c8053b0447cf954bde1 SHA-256: d650ae877c815d0b99b8ec18c86277c1357c7b134969fc86770bb1c874ef11df
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also strongly flagged this PDF as malicious. The embedded URL, https://gettraff.ru/strik?keyword=phantom+of+the+opera+pinball+machine+for+sale, is the primary indicator of malicious intent, likely serving as a lure for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=phantom+of+the+opera+pinball+machine+for+sale In PDF document text
    • https://cdn-cms.f-static.net/uploads/4380531/normal_5f8ba151ec072.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417206/normal_5f9ed42933906.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459776/normal_5fa1dc0f41642.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391326/normal_5f97888e69f74.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386849/normal_5f9a1a50560ad.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403679/normal_5f9f61e33d620.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/886055f8-0314-41fe-92c3-b1b5b41479b9/62129285218.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/640d1cf2-0b6f-40ea-83b5-0b99023a0f9c/acer_aspire_3680_bluetooth_driver_windows_7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/440ca2ba-ace0-48c5-97b4-05f22e64ad5c/different_types_of_cleavage.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a96b021-a54b-40ab-92ad-9874dbd872c0/tuxogifaxoxakufom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4a36d87-3b47-4ff4-88e4-347cd440c08c/74257259730.pdfIn PDF document text
    • https://s3.amazonaws.com/vatakefojunib/58286983158.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/578d4c92-a06d-4225-bd30-b3927b07cfa7/gabawafoligafuduwizopome.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000537c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x537C 5396 bytes
SHA-256: 1a29e0ad413deaae79056ace4e34f18799c68b0b626046c5dbc1454797b82786
font_01_sfnt_off000065ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65AC 12012 bytes
SHA-256: 14945cb80844f2de007d0201b3014cbeb65a7920ce58142c76361d7014ec7493

Open this report in the interactive analyzer, or submit your own file for analysis.