Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cb789f6f790afb9…

MALICIOUS

PDF

35.6 KB Created: 2020-11-07 01:14:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b908c035b819e5ea10f75e01a2b7415e SHA-1: 9200c6436cf212827e8f672fc794f59097d92844 SHA-256: 3cb789f6f790afb9029343f04ce3ec3c557c8d372992f07f553b6be7938c513f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link that redirects to malicious infrastructure, disguised as a movie streaming service. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms this behavior. While no scripts were extracted, the document body contains a URL that is likely intended to lead the user to a malicious site, potentially for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=watch+spiderman+homecoming+online+putlockers
    • https://cdn-cms.f-static.net/uploads/4373261/normal_5f8a11401ad3f.pdf
    • https://cdn-cms.f-static.net/uploads/4366637/normal_5f87869f142bc.pdf
    • https://nonudefetug.weebly.com/uploads/1/3/4/3/134314303/72fc3341.pdf
    • https://wonidajubiput.weebly.com/uploads/1/3/4/0/134017859/1570698.pdf
    • https://norigawe.weebly.com/uploads/1/3/3/9/133988483/6576976.pdf
    • https://cdn-cms.f-static.net/uploads/4383804/normal_5f938c33c9ebc.pdf
    • https://cdn-cms.f-static.net/uploads/4394068/normal_5fa0a96f60395.pdf
    • https://cdn-cms.f-static.net/uploads/4384820/normal_5f91c02e48241.pdf
    • https://cdn-cms.f-static.net/uploads/4403130/normal_5fa246793a9de.pdf
    • https://jizufozerujit.weebly.com/uploads/1/3/4/3/134343201/nogapuwaralonodujore.pdf
    • https://cdn-cms.f-static.net/uploads/4370057/normal_5f87f626bc08f.pdf
    • https://uploads.strikinglycdn.com/files/a187b2d1-f1d8-49ce-bd8f-725fd7064810/98430836249.pdf
    • https://s3.amazonaws.com/gupuso/key_marketing_concepts.pdf
    • https://uploads.strikinglycdn.com/files/4937f311-2122-4bcc-96c4-7336cbb76346/fixaxituvifalutiguroz.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.