Malicious PDF — malware analysis report

Static analysis result for SHA-256 f86dd5aebee1f739…

MALICIOUS

PDF

71.6 KB Created: 2020-12-29 23:42:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 497b822acbdd8f8dcfcf923eb9be1ab1 SHA-1: 59a379f152f9899facf8ff4d30e7494d38b07030 SHA-256: f86dd5aebee1f7394bf6852276722790c895e185985ac2a89b621c5b599f37ee
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ggtraff.ru'. This URL is likely used to lure victims to a phishing site or download further malicious content. The ML classifier also strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=eric+carle+books+online
    • https://static.s123-cdn-static.com/uploads/4380210/normal_5fdf59a268e66.pdf
    • https://cdn.sqhk.co/fifapupifig/XUZEBih/87840212658.pdf
    • https://cdn.sqhk.co/pojuwudedi/g76ihgd/87263029857.pdf
    • https://cdn.sqhk.co/monasomeb/Tggh7hb/xobogimididoto.pdf
    • https://cdn-cms.f-static.net/uploads/4403937/normal_5fd12c9a916c5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bce9e8f3-57bb-4001-804b-de0a9d5ac14b/rudijakugizukepakab.pdf
    • https://uploads.strikinglycdn.com/files/54ea5a96-9bd0-4c84-8ddd-4008fa6372aa/ensino_as_abordagens_do_processo_resenha.pdf
    • https://s3.amazonaws.com/palikuvexake/lagu_terdiam_sepi_dj_remix_stafaband.pdf
    • https://uploads.strikinglycdn.com/files/38c1a927-7cc5-4510-9376-61f06fc39aa0/chemical_bonding_pogil_activity_1_answers.pdf
    • https://s3.amazonaws.com/punagilelabon/bitekiguv.pdf
    • https://uploads.strikinglycdn.com/files/42062ff4-882d-4896-9afc-d15a03b657ea/borezusafijezureb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbee.bin
c0e92592c45b78aa19072e5b26dac558f1ab387d465ebe0093f284c6d45a4f61		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBEE 4952 bytes
font_01_sfnt_off0000ecd7.bin
7ac5ea6207dd1a4d11a1d34bee0f26afd099540824b75f4b0f2eba363d40d661		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECD7 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.