PDF malware analysis — malicious · 0b268a30ed2862ba

MALICIOUS

PDF

26.9 KB Created: 2020-11-08 08:21:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: cf99afdff89b5546489558257322afc7 SHA-1: 4eca4072360f276d8bebb05f17c1f0765141112f SHA-256: 0b268a30ed2862baaab427f3c1df2c9f0dd30eef8b98e968e04a58f3b9b6a47d

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to link farms or redirectors, indicating a malicious intent to drive traffic to potentially harmful sites. The primary malicious link identified is https://gettraff.ru/123?keyword=church+militant+field+manual+pdf, which is flagged as a known malicious redirector. The document body, though heavily obfuscated, also contains this URL, reinforcing its role in the attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9987

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/123?keyword=church+militant+field+manual+pdf
- https://xavujome.weebly.com/uploads/1/3/0/7/130739328/rukorobukojudakarexa.pdf
- https://cdn-cms.f-static.net/uploads/4368964/normal_5f8ddc5f408c9.pdf
- https://cdn-cms.f-static.net/uploads/4382193/normal_5f9778f2e4ce0.pdf
- https://kazajibabagak.weebly.com/uploads/1/3/4/4/134467412/5626243.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/nokiwovowus/the_passionate_shepherd_to_his_love.pdf
- https://s3.amazonaws.com/pisik/vlookup_in_excel_2010_in_hindi.pdf
- https://s3.amazonaws.com/libowebujakux/farowesemakirijaza.pdf
- https://s3.amazonaws.com/satudifin/58452767918.pdf
- https://s3.amazonaws.com/xanebavifamopez/difaxarusovinefepikenopif.pdf
- https://s3.amazonaws.com/miwolezedubujoz/orthographic_to_isometric_view.pdf
- https://s3.amazonaws.com/memul/rugoguwesa.pdf
- https://s3.amazonaws.com/vutame/epf_kyc_update_form.pdf
- https://s3.amazonaws.com/lanubili/cianix_side_effects.pdf
- https://s3.amazonaws.com/zizene/90099063761.pdf
- https://uploads.strikinglycdn.com/files/9dd46405-af21-44fe-a18d-be1133956b7c/veziwugedakisuzu.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004f5b.bin` `bb65471001f732e3e3aa5354cd7475db82fa5ab9a0a0e6237b39e5902ee9806d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4F5B	5124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.