PDF malware analysis — malicious · 32a7dfe17bfe7dc1

MALICIOUS

PDF

101.6 KB Created: 2020-11-05 21:03:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ff90b883bcf4ddb72e8a3e17d264b52d SHA-1: 9f98a650146a8bbe4d52392c2a327dfaf41ab734 SHA-256: 32a7dfe17bfe7dc1925ac67634bab86021df8baaa0b91659f40a999e9a5d9c03

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many pointing to S3 buckets, suggesting a link farm or SEO poisoning attempt. The primary URL, 'https://trafffi.ru/aws?keyword=wilson+elementary+school+richmond+california', is likely a lure to direct users to a malicious site. The ML classifier strongly indicated maliciousness, and the PDF structure itself is flagged for containing a mass of external links.

Machine Learning

Nyx PDF Classifier malicious score 0.9953

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?keyword=wilson+elementary+school+richmond+california
- https://ditiwudo.weebly.com/uploads/1/3/1/4/131452947/4c1644748.pdf
- https://fisabovetusita.weebly.com/uploads/1/3/4/5/134597566/e64baaa43129.pdf
- https://cdn-cms.f-static.net/uploads/4369330/normal_5f8ddefe9892d.pdf
- https://cdn-cms.f-static.net/uploads/4366406/normal_5f8abcbd88c0a.pdf
- https://cdn-cms.f-static.net/uploads/4368989/normal_5f88ce507e613.pdf
- https://s3.amazonaws.com/zugutixe/89997440515.pdf
- https://s3.amazonaws.com/fibesezati/9070489814.pdf
- https://s3.amazonaws.com/lupebesu/kadanijomijeputo.pdf
- https://s3.amazonaws.com/livivuvuwugeb/barron_s_3500_word_list_with_hindi_meaning_download.pdf
- https://s3.amazonaws.com/wajufifenoxuj/sivaloribidovogulizigokek.pdf
- https://s3.amazonaws.com/wogikokuzotaxa/jerkline_skinner_definition.pdf
- https://s3.amazonaws.com/damerirazib/rorobiwowepawetilufisuzi.pdf
- https://s3.amazonaws.com/dazifozixawus/antecedentes_historicos_de_la_administracion_resumen.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.