PDF malware analysis — malicious · 26fcead93f5f86dd

MALICIOUS

PDF

52.6 KB Created: 2020-12-30 00:49:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7391f511fbd8848cadbf60ef90d8c3f4 SHA-1: b0bb2bcfe1d184d64d8bfaa107ebf921a54883c6 SHA-256: 26fcead93f5f86ddf6daadf18da8a637deac2962286391d4d3161b92b0cb5b61

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link that redirects to a known malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also flagged the document as malicious. The embedded URL is likely intended to trick the user into downloading malware or visiting a phishing site, disguised as a Bandicam download.

Machine Learning

Nyx PDF Classifier malicious score 0.8248

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/strik?utm_term=bandicam+screen+recorder+download
- https://static.s123-cdn-static.com/uploads/4387408/normal_5fc8d4fdb40b6.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/toguvaju/ansible_template_conditional.pdf
- https://uploads.strikinglycdn.com/files/4ee4d015-1060-428e-ad37-04e45f13117c/toys_r_us_charitable_giving.pdf
- https://s3.amazonaws.com/suxiweke/pokemon_tower_defense_3_android.pdf
- https://uploads.strikinglycdn.com/files/588500b7-c4b1-41ad-aea0-9ad15edb2c34/sisojikasibaxe.pdf
- https://s3.amazonaws.com/dazifozixawus/31947616958.pdf
- https://s3.amazonaws.com/fulosobezur/sosudupararotoxol.pdf
- https://s3.amazonaws.com/jasipefulaxiduj/is_colleen_ballinger_divorced.pdf
- https://s3.amazonaws.com/rodigapigeta/luxewomumupidiv.pdf
- https://s3.amazonaws.com/taturi/vojupiseb.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000be88.bin` `cda83596d8860ee3db0d2042596d0bd9271d2838e63e08caed5eadbad12bdcd5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBE88	5228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.