Malicious PDF — malware analysis report

Static analysis result for SHA-256 dede7248bab15471…

MALICIOUS

PDF

22.2 KB Created: 2020-10-01 23:20:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 336d052a44c6bd544a6cfdf4fbd3ca7f SHA-1: b3c76cd20e55d0a19686b7444f0d4eda1e8675ea SHA-256: dede7248bab15471087a1059285e944e293563ebe3af7820105c00cb024fefa2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://gettraff.ru/strik?keyword=zaza+remote+apk+mod', suggesting a lure for potentially malicious content. The presence of numerous external links, including benign ones, indicates a link farm strategy to obscure the malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=zaza+remote+apk+mod In PDF document text
    • http://bezowuguk.portaldosrestaurantes.com/uploads/1/3/1/4/131483083/8276295.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/45293d22-d0d6-403e-85f0-ca75a5f69e57/93709237302.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85801fde-0ea2-45fe-9440-a35c7a166769/fasuwomuruxumofexa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b2d17a7-fc36-4895-9226-df468dd7a691/98523441451.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae20fd6e-3719-4468-a2c0-281c2125f5b2/ribazezema.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dac73daf-f169-400f-bc93-26f486e53f54/7793915044.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/8016/3229/files/23495437358.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/1807/9386/files/meharry_dental_school_demographics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff5aa4ab-1056-4b13-9ed3-9b9542c3de0a/65316300276.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4ed3403-abb6-4785-a386-d4fdf1e408c0/16137057392.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f8df074-7b7a-44db-a388-b9a533ad8e44/wovexesiwusuribenininib.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B3A 4964 bytes
SHA-256: 891020bb1671c336f93c9f33d8144adfa69f04ea7e4122d83c4b73a5c8b373d6

Open this report in the interactive analyzer, or submit your own file for analysis.