Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6660cec3dd882da…

MALICIOUS

PDF

73.5 KB Created: 2020-12-16 01:50:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 885689724b20a0dcce00e3638b1022f6 SHA-1: 019f1260914fa97b7b1383722c5e84b34d73df37 SHA-256: e6660cec3dd882daf4f22b8a725e563eb2901cb51d2b02365a6c634d6cb317b3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ggtraff.ru/aws?utm_term=leila+lopes+answer'. The ML classifier also strongly flagged this PDF as malicious. Although no scripts were extracted, the presence of a malicious URL within the document body suggests a phishing or malware distribution attempt, aligning with the Spearphishing Attachment technique.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=leila+lopes+answer
    • https://static.s123-cdn-static.com/uploads/4480393/normal_5fca06db01b0b.pdf
    • https://gituruledutaza.weebly.com/uploads/1/3/4/4/134401886/wuvuj.pdf
    • https://cdn-cms.f-static.net/uploads/4415518/normal_5fb2c8e868c6e.pdf
    • https://cdn-cms.f-static.net/uploads/4374986/normal_5f946b2d21103.pdf
    • https://cdn-cms.f-static.net/uploads/4419413/normal_5fd82c07d9a87.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5c172dd96f5918e62ce7/1606376472194/domain_and_range_of_a_function_worksheet_kuta.pdf
    • https://static1.squarespace.com/static/5fcee4934d27a4470988e4d6/t/5fd649f4acac596b0cb6cfa9/1607879157082/adventuring_through_the_bible.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf11bbc819f1cf49d91bb/1606283553186/54567682700.pdf
    • https://uploads.strikinglycdn.com/files/e04c165b-8f1e-4264-9e3d-477463ba1735/jamonozizogegotale.pdf
    • https://static1.squarespace.com/static/5fc29d8640f1034a5cb3e639/t/5fca9a5352c55e381a179ea7/1607113303566/72761638919.pdf
    • https://static1.squarespace.com/static/5fc6c2e8bcf5f06bcb74575b/t/5fcd04f3eb18547f4b882894/1607271668636/english_song_ringtone_app.pdf
    • https://uploads.strikinglycdn.com/files/0424dd81-8d12-432e-bc0e-67f0d348fa61/apostilas_de_crisma.pdf
    • https://uploads.strikinglycdn.com/files/25af64cf-9986-44b1-ac26-586163e27158/fabadilanewo.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6a77145a8629dca98c93/1606380153092/measuring_respiration_worksheet_answers.pdf
    • https://uploads.strikinglycdn.com/files/665cc9f3-8cce-4cf0-afd2-bd81511b0f46/gamecube_emulator_android_apk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d387.bin
3b4604d09f9a35689a2d6033cf41bedc4cb9b3e115e26495a1e963d4c6390188		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD387 4552 bytes
font_01_sfnt_off0000e2ff.bin
16e4a6eaaf2efffa92358db74c39bca929d478ab816a225303aa795492b893be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2FF 12368 bytes
font_02_sfnt_off00010ac3.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AC3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.