Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfee5ab80e43ca8c…

MALICIOUS

PDF

78.4 KB Created: 2020-12-05 16:51:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: aadf2bbfa34c37544f3b06f62d3184a8 SHA-1: 80684be42ed75c62c1a59c77d0b2218b2396f190 SHA-256: dfee5ab80e43ca8cd42f597d2b42d82bf46c550c0e506972cdc175491f77553f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing a malicious redirector link, as indicated by critical heuristic firings and ClamAV detection. The embedded URL, https://ggtraff.ru/123?utm_term=imdb+vampire+academy+2, is flagged as malicious and likely leads to a phishing or malware distribution site. While no scripts were explicitly extracted, the PDF structure and malicious link suggest an attempt to compromise the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=imdb+vampire+academy+2 In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/53716c3f-13a7-4560-90e6-a0faa9da81e7/21017523585.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1916592-9330-4e11-83f1-b80e76a085a7/94781128490.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfad179c08c7f2b9ec071/1606220498008/ready_player_one_online_free_watch.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc13d0827a199023ab79d37/t/5fc27f303c6ccf69f3af033d/1606582065139/63451243393.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc678639698b02c7f46ff01/t/5fc88b3e13f8d93bf207ed08/1606978366805/caption_for_profile_picture_tagalog_sad.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10b9cab79f442f22a6952/t/5fc31c243c02f22b9d735f96/1606622244902/i_spy_lyrics_pulp.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a8c4764-4b3b-400d-adee-89f89e11245d/katelyn_nicole_davis_morgue_photo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6fd919849b27a00a3c0c7/t/5fc7bd947995075abdefdfab/1606925716407/xuzevisuk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ee6ea6e-08a6-4db8-bed2-66c97a293407/27748107534.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e727ea4a794d5645064f/t/5fcacb3c08ddca70c743e26c/1607125820947/katuxezasagu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae8e4fdd-12f6-46e0-b889-441721a3d39e/1541249948.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1b51b40f1034a5cae9388/t/5fc3aab9a97599144e683d9e/1606658746120/61403129503.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e0febe9b6939510aa6a3/t/5fc1676c3570fb44d13754dc/1606510444567/wevazenefoxifajigapigoti.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc3c939bd14ff0dd2ae97c9/t/5fca810fc96dea2b5bbeee09/1607106831621/jizafitosomusuw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b1da05a-f23f-481b-b8f9-86cd8ee448f9/90986734602.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0052111f6a4198480c96b/t/5fc0e4343485235c86e73f2f/1606476854638/create_the_atomic_orbital_diagram_for_chlorine.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f355.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF355 5380 bytes
SHA-256: 7c8f0a498b88682268dae52cee9b6ce554d09d924da67953200dee9b529c0230
font_01_sfnt_off00010595.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10595 11476 bytes
SHA-256: b9a603bb7731871f8eeccea3194b0f4d71de13c0ce753b2beb5bf6e6100527e9

Open this report in the interactive analyzer, or submit your own file for analysis.