PDF malware analysis — malicious · 2626ce29ca12d80f

MALICIOUS

PDF

23.6 KB Created: 2020-11-06 05:17:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d7f2a1e95143de20ea3a304235c3e957 SHA-1: 43e99c5c5b2a4741faba2fbad9a163dc88dec9a6 SHA-256: 2626ce29ca12d80ff05ada3d3ac4091fe8fc0a15a40c60610a48949e973ce92f

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic indicating it links to known malicious redirector infrastructure. The embedded URL, https://cctraff.ru/strik?keyword=neo+geo+pocket+emulator+apk, is the primary indicator of malicious intent. While no scripts were extracted, the presence of a malicious redirector strongly suggests the document is designed to lure users to a harmful site, likely for further exploitation or credential harvesting.

Machine Learning

Nyx PDF Classifier malicious score 0.9975

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=neo+geo+pocket+emulator+apk
- https://cdn-cms.f-static.net/uploads/4375525/normal_5f8af8427a439.pdf
- https://cdn-cms.f-static.net/uploads/4366050/normal_5f973c566d7b3.pdf
- https://cdn-cms.f-static.net/uploads/4366959/normal_5f88beae36e2a.pdf
- https://cdn-cms.f-static.net/uploads/4387428/normal_5f8fb37eb3abb.pdf
- https://cdn-cms.f-static.net/uploads/4454432/normal_5fa4800857c3c.pdf
- https://cdn-cms.f-static.net/uploads/4382420/normal_5f9767b7d26f0.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/2d8326e6-d9ea-4096-a6ac-f72cf08f44cb/85596899039.pdf
- https://uploads.strikinglycdn.com/files/2e05d68f-ba5e-4100-b7bd-c796a6b932d2/vesuxidin.pdf
- https://uploads.strikinglycdn.com/files/cc7471ce-2bd4-45a5-b21f-5d25637323b9/94462836590.pdf
- https://uploads.strikinglycdn.com/files/56bd1f02-1f0a-4496-a049-88b47cb947ef/jabupudowewutitavevovej.pdf
- https://uploads.strikinglycdn.com/files/e08917de-5060-43ec-b8e2-5b2ac51d8b3d/3568262273.pdf
- https://s3.amazonaws.com/janodojivi/97356297821.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004fd6.bin` `a3303ebcd3d00372fcc808682126b64afb9c920066a207eca0925758274ce624`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4FD6	5108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.