Malicious PDF — malware analysis report

Static analysis result for SHA-256 d81624f0401e9175…

MALICIOUS

PDF

46.7 KB Created: 2020-10-28 10:50:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 856a5f346434662e742ae56f626ca241 SHA-1: 7f309363bbfe68d1c130ea74f40792a9d9c044b5 SHA-256: d81624f0401e917551d97ddcc8a8b88bdb031c3c23d509823784e9a9a0a88b3a
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://ggtraff.ru/123?keyword=sensorcon+inspector+manual' is identified as a malicious redirector. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of a malicious URL in the document body strongly suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=sensorcon+inspector+manual In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/84f3e0ae-aeff-4814-a29f-0505a99e1193/13517814966.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cc61de0-27be-471c-b2ea-124be79f3785/jaranigegubakuwer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d194a163-5def-46d9-b5a0-632c766d26dc/tv_show_proposal_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9111b4f0-e6b5-44bc-a239-459bad2996e5/duwalopajixeteta.pdfIn PDF document text
    • https://s3.amazonaws.com/wizidimawag/biology_form_4_chapter_1_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/tumasun/que_es_el_catabolismo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/43359e40-2ad0-49f1-95f6-181759fe2ad3/7156349514.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a24c0a7c-73f3-414f-85bc-7884c4d98faa/wedding_planner_guide_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5dc44fe8-f515-48cc-83f1-091f989ab1c9/viganemugabibezesegodosev.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/mubivutifejuwajazar.pdfIn PDF document text
    • https://s3.amazonaws.com/fizaxo/74389604672.pdfIn PDF document text
    • https://s3.amazonaws.com/wunupalezozerud/jekodinudakukunenixakisud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/357c5965-8043-43f1-89f2-76701e104a3e/division_de_fracciones_algebraicas_e.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5485e3c-e81e-4dbe-a5a4-8692ab357353/17694450325.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19c60967-e650-48bf-936a-e3d2d5ba32fa/el_juicio_de_amparo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1412f394-00ee-43f6-8e2d-91c28ee4359a/would_could_should_exercises.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77e76bd5-1dd4-4a17-bc45-e0e8cac3da26/rafuvipemajo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fce9c09c-12ae-42eb-8791-bc9a8fa5fac7/purinamoxomarudedak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/864f579b-f55e-4fb2-b6bc-f852976ed924/42320339894.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000751a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x751A 5180 bytes
SHA-256: 14196b66cedf494be48c6a3ae7ad88255a358ac93041942dfc3ca3c9a289c564
font_01_sfnt_off00008696.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8696 11544 bytes
SHA-256: 53b52cf5f9262cbcd4435a22716a473b42f226b23c18af3719a5324e2a3e1ecd

Open this report in the interactive analyzer, or submit your own file for analysis.