PDF malware analysis — malicious · 17267b0a8bd1d5b7

MALICIOUS

PDF

35.6 KB Created: 2020-11-01 18:51:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 404cc5b36ab24b360e6ca69309a1567f SHA-1: fe9865df0a0b0abf8f4f23acaf75b1de74800551 SHA-256: 17267b0a8bd1d5b707674dd89bd0b898d6f3efadddd51682e77ea2cfa7a3c125

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ggtraff.ru/aws?keyword=nrmp+rank+lists+due'. The document body, though heavily obfuscated, also contains this URL. The embedded link in the PDF document's annotations further reinforces the malicious intent by listing multiple suspicious URLs, including the primary redirector. This suggests the file is designed to lure users to malicious infrastructure.

Machine Learning

Nyx PDF Classifier malicious score 0.9769

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=nrmp+rank+lists+due
- https://welavofewefose.weebly.com/uploads/1/3/0/8/130813025/8030975.pdf
- https://sedogosep.weebly.com/uploads/1/3/4/4/134486754/xazijofewuzusu_migidobomuf.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/a8401ec7a9859.pdf
- https://fifowekuvepu.weebly.com/uploads/1/3/0/7/130776735/vipulimuguv.pdf
- https://s3.amazonaws.com/petuzutemixuvod/87703893698.pdf
- https://s3.amazonaws.com/daselex/canadian_citizenship_test_guide.pdf
- https://uploads.strikinglycdn.com/files/f1a94815-9f91-4122-96e3-029e38f69f53/31497525024.pdf
- https://uploads.strikinglycdn.com/files/671c391e-ac32-4b6e-8a1f-e0cc4c924617/wilderness_survival_merit_badge_answers.pdf
- https://uploads.strikinglycdn.com/files/4a0a3453-9a1d-4928-9b01-477993e055d6/31962941096.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.