Malicious PDF — malware analysis report

Static analysis result for SHA-256 db29ac7dc701ba16…

MALICIOUS

PDF

18.6 KB Created: 2020-11-04 01:50:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5488e38d7c94f210681671c2464f82b7 SHA-1: e6419f3fecf773c60d6eb494b62ee82a0204727d SHA-256: db29ac7dc701ba16966b7b236469b724ef445be83ccc672a0891d25c89e8488e
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a malicious redirector link, employing an image-only lure typical of phishing attempts. The embedded URL, https://gettraff.ru/aws?keyword=backstab+mod+apk, is a primary indicator of malicious intent, likely leading to a phishing page or malware download. No scripts were extracted, but the PDF structure and URL strongly suggest a spearphishing attachment attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=backstab+mod+apk
    • https://cdn-cms.f-static.net/uploads/4374984/normal_5f9e0b53d95b3.pdf
    • https://cdn-cms.f-static.net/uploads/4366350/normal_5f871d652d459.pdf
    • https://cdn-cms.f-static.net/uploads/4414678/normal_5f952313b3453.pdf
    • https://cdn-cms.f-static.net/uploads/4377902/normal_5f8a03306e1e2.pdf
    • https://cdn-cms.f-static.net/uploads/4368735/normal_5f8eebb301483.pdf
    • https://cdn-cms.f-static.net/uploads/4379385/normal_5f95530eb9795.pdf
    • https://uploads.strikinglycdn.com/files/3867a69e-b364-4ef7-bfbf-afd2c74f9bf2/hitchhikers_guide_to_the_galaxy_q.pdf
    • https://uploads.strikinglycdn.com/files/065c86ab-6f4f-4b84-9cee-9aa4a9762d00/56986525345.pdf
    • https://s3.amazonaws.com/tapexiw/speed_formula_calculus_bc.pdf
    • https://uploads.strikinglycdn.com/files/db9130c9-9c9e-4ca7-b906-cb6977f86b81/4330103526.pdf
    • https://uploads.strikinglycdn.com/files/3dd07d41-6c61-4591-ae68-029af4e8f737/tonin.pdf
    • https://uploads.strikinglycdn.com/files/5f72fbbc-c6a3-4999-8e67-1f11077f7933/what_is_psychology_worksheet_answers.pdf
    • https://uploads.strikinglycdn.com/files/ac25bb59-24b2-4ac3-b745-d6356bf3fac1/13549686112.pdf
    • https://uploads.strikinglycdn.com/files/ecb27327-61f5-4776-8d59-3325ba695470/tiberius_t8_1.pdf
    • https://s3.amazonaws.com/jedobufudajewu/bioassay_of_serotonin.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.