Malicious PDF — malware analysis report

Static analysis result for SHA-256 eeee138e6db8a910…

MALICIOUS

PDF

49.6 KB Created: 2020-11-04 03:14:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: b57054d9f5931a39eacda8b74d078386 SHA-1: 68ceadd54ea70737d29c4aedd3e4be118422adc0 SHA-256: eeee138e6db8a9102d3c19ea856a8763f28d0f630d831cd5328a625612b303e3
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by a machine learning classifier and heuristics indicate it contains links to known malicious redirector infrastructure. The embedded URL 'https://gettraff.ru/aws?keyword=akuma+super+street+fighter+2+turbo' is a primary indicator of malicious intent, likely serving as a lure to a phishing site or a download host. The document body, though heavily obfuscated, contains this URL, reinforcing its role in the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=akuma+super+street+fighter+2+turbo In PDF document text
    • https://kilunifogewawo.weebly.com/uploads/1/3/4/4/134457757/xikog.pdfIn PDF document text
    • https://kageketiwef.weebly.com/uploads/1/3/4/5/134581137/b25cca3652497.pdfIn PDF document text
    • https://pukotegifo.weebly.com/uploads/1/3/0/8/130874060/3340f6.pdfIn PDF document text
    • https://ralawuxageg.weebly.com/uploads/1/3/4/3/134319431/gitaxe_zunekikez_ritota.pdfIn PDF document text
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/6529121.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366627/normal_5f873e649042f.pdfIn PDF document text
    • https://tezosarotijup.weebly.com/uploads/1/3/4/3/134305137/movag.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zupenafud/sojewo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7406553-9e6a-4fd0-9aed-1447a7e94e30/64600821057.pdfIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/animal_tissue_culture.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/98051299622.pdfIn PDF document text
    • https://s3.amazonaws.com/rorives/ipad_16gb_wifi_only.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d751b9e-1601-4357-b18c-2b97830dbeaf/miracles_by_stuart_wilde_free_download.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009a74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9A74 5384 bytes
SHA-256: 87e99fc90a8acf06435c90cdcd0e8ebb6334e382c1f3e22032764e3106a239e6

Open this report in the interactive analyzer, or submit your own file for analysis.