Malicious PDF — malware analysis report

Static analysis result for SHA-256 f710bdcb5ef075b2…

MALICIOUS

PDF

51.1 KB Created: 2020-09-29 21:32:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eed0b462438dff69b62683caddf6ec67 SHA-1: 26f48dadc671ad5c0e1420b65b95d1aaa7b71c04 SHA-256: f710bdcb5ef075b28bd35d58b35e62b9e599c80c930a1ffdc0cafff22c0fc41a
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ggtraff.ru/strik?keyword=lactulose+in+hepatic+encephalopathy+pdf'. The document body, though heavily obfuscated, also contains this URL, suggesting it is the primary mechanism for delivering a malicious payload. The presence of urgency language in the heuristics further supports a phishing or social engineering attack vector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=lactulose+in+hepatic+encephalopathy+pdf
    • http://files.kathyarcher.com/uploads/1/3/1/4/131406537/6624832.pdf
    • http://files.ta-tribe.com/uploads/1/3/1/1/131164322/4ece61225ff.pdf
    • http://vuneviwif.naxosonlinelibraries.com/uploads/1/3/1/3/131381088/1061167.pdf
    • http://files.cdastudio.org/uploads/1/3/1/6/131636692/13c15198.pdf
    • http://files.fusiontheatre.com.au/uploads/1/3/1/6/131637190/repivokapanu.pdf
    • https://uploads.strikinglycdn.com/files/0dca159c-a372-4d64-9c42-55e565cc4356/fagumobakudesov.pdf
    • https://uploads.strikinglycdn.com/files/127a4396-1dd3-4dbc-bf20-7ec856263b25/lexupeteni.pdf
    • https://uploads.strikinglycdn.com/files/949c2a7e-5ba9-4abc-a4ba-47bd14288a32/jusewododazikemosiz.pdf
    • https://uploads.strikinglycdn.com/files/525ae76e-1d27-4757-8e28-1b1e8646755d/xotiwuwifavamivu.pdf
    • https://uploads.strikinglycdn.com/files/a1a5232b-5fd4-42b7-9784-40c1700bd9f9/12692885491.pdf
    • https://uploads.strikinglycdn.com/files/9a22db97-5d4a-49af-b665-af258be453cc/bogeragovetexejatimok.pdf
    • https://uploads.strikinglycdn.com/files/68698376-0a32-4a60-95d2-54cf5b225210/50575446953.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007ba6.bin
932f91b67f3f445ad64cf6d074731f8dddb754bedde321fa606c9f89abc3a448		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BA6 5072 bytes
font_01_sfnt_off00008ce7.bin
31c1b7d2f35fd8683a28b6f3775655b336c7abecbda984bb6c1d71d996e8622d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CE7 10764 bytes
font_02_sfnt_off0000b11c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB11C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.