Malicious PDF — malware analysis report

Static analysis result for SHA-256 e77faae0e7c91792…

MALICIOUS

PDF

67.4 KB Created: 2020-11-25 14:46:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 6c4dc7fc59236df6d1a8cdefc4086136 SHA-1: d9cd5ef16236317afc0e5e0f7df6dec7c6cd7440 SHA-256: e77faae0e7c91792aea7da1a261fd1e4682ee7a4d139a0123f7fc3bc00f7e33a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://traffmen.ru/aws?utm_term=great+synonym+formal'. This indicates the document is designed to redirect users to a potentially harmful website. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?utm_term=great+synonym+formal In PDF document text
    • https://cdn-cms.f-static.net/uploads/4391326/normal_5f904b5c54a60.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/81d2af7c-c9c3-4862-9c10-d06ea59a3235/smart_board_6000_series_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8be19e9-4a96-4ed9-ab89-1679399a255b/kajerorituwewawegiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a52d533b-f679-45bf-9b57-47c73427833c/dnd_hand_of_vecna.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84d59515-11db-49fc-b7b4-625abcea73bf/burud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c514c1f-bd8c-4e9d-9cce-c18feffba2ba/zaxewovodixumogarof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fada277-25a9-425a-a01d-81a271dcffe8/wargame_red_dragon_cheat_engine.pdfIn PDF document text
    • https://s3.amazonaws.com/dogazisuze/jovalor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9afd105-af41-4110-ab26-64e7f81787d1/take_on_me_high_note.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e929f21-513d-4f90-8545-687fa106af81/nogajupowunuwe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55a9fea6-987e-4827-8d6f-c9ce60085eee/crest_high_school_shelby_nc_graduation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d866c8d-792b-4f2f-a7c3-ba4805a0e3ed/31931100339.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32322aab-c522-4926-87c6-f88ac1c6cf35/world_cup_kicks_2014_unblocked.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c96c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC96C 5044 bytes
SHA-256: af8080eea3cdfcc04241c7438653bad67a182eb65b66eb9f9903d5d79bd1f6c6
font_01_sfnt_off0000da88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA88 11364 bytes
SHA-256: 963a9021c8df9297e497c7072d31410e5f1fe722d6060f0d00b7d0d220629bdc

Open this report in the interactive analyzer, or submit your own file for analysis.