Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef5f6db6844fb272…

MALICIOUS

PDF

58.6 KB Created: 2020-10-12 10:46:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 79b92e53ce9608ed823510a7ad297770 SHA-1: d1c1f111a2ad0d296a32afcf71bf314f1f092e05 SHA-256: ef5f6db6844fb27261ea322d6982467bc0e3777d7295673eb68a07410352750c
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a malicious redirector link pointing to 'ggtraff.ru', which is flagged as malicious infrastructure. The ML classifier also strongly indicated maliciousness. While no scripts were directly extracted, the presence of a malicious URL within the document body suggests an attempt to lure the user to a harmful site, likely for phishing or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=jungle+book+short+story+pdf In PDF document text
    • http://gojuto.echeloncatapult.org/uploads/1/3/1/4/131406840/cd1bb7e7.pdfIn PDF document text
    • http://vetererat.brianaowenphotography.com/uploads/1/3/0/7/130738720/ripovizaxoke.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/0876/4321/files/tilt_at_windmills_saying.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0457/6618/1028/files/dolphin_pro_apk_2019.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/2601/4620/files/gloucester_township_schools_reopening.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/290ed1b0-1c61-485a-a03c-162a6906651e/kawewokolurureku.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a00536d1-a270-4895-8cf5-2692fdabe2c0/xaritefagarejefuda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc26a6ef-168c-42f9-a11d-b5d37ff370e5/kizopa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdbde261-a7ee-4791-ba5c-27d0ccfa918f/beboxiwusanobukikegoni.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c04a6559-1e0f-4d0e-8d3e-e29a2e4ab8fa/92381390019.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/5911/8229/files/beyond_skyrim_bruma_sedor_boss_chest.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/1298/7802/files/19500257731.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/0190/3766/files/tikid.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a160.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA160 5388 bytes
SHA-256: b473161d45e790864ea1d064ade64be4769f91b6412dcef94e2a2245eb441586
font_01_sfnt_off0000b3ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB3AB 10340 bytes
SHA-256: dace155b9d34a35c5d59001e43b147175abda816c2e2bf49489676bfc44d9e34
font_02_sfnt_off0000d753.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD753 2888 bytes
SHA-256: bc2ef8a476aa244ba7f05861efa3254801abd3d7cb6c35d83da122bdb0f5ba23

Open this report in the interactive analyzer, or submit your own file for analysis.