PDF malware analysis — malicious · 43b58e61d6f0c57b

MALICIOUS

PDF

34.7 KB Created: 2020-10-28 23:44:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e77282aae56e810c599a34ed6b37b53a SHA-1: b9399cd0eb2ead9070572071c347f1b75f914bfe SHA-256: 43b58e61d6f0c57b22f4f3a7f17edb9306ceec3385a81d0fc36c4a6bd28ac745

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'earbuds manual' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The presence of a link farm further indicates an attempt to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=jam+live+loud+earbuds+manual
- https://cdn-cms.f-static.net/uploads/4386836/normal_5f97fd9adadff.pdf
- https://cdn-cms.f-static.net/uploads/4427077/normal_5f99df96d042c.pdf
- https://cdn-cms.f-static.net/uploads/4366645/normal_5f88bb7e42132.pdf
- https://cdn-cms.f-static.net/uploads/4365608/normal_5f87087d7dbaf.pdf
- https://vimikipemaw.weebly.com/uploads/1/3/4/3/134331773/gukuga.pdf
- https://xonuveviriniw.weebly.com/uploads/1/3/0/7/130738603/fejajowi.pdf
- https://cdn-cms.f-static.net/uploads/4378379/normal_5f922946a8bce.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/peveziwoguxuzam/blue_moon_calories_22oz.pdf
- https://s3.amazonaws.com/gapivegek/aciduria_glutrica_tipo_1.pdf
- https://s3.amazonaws.com/susopuzupure/mupapona.pdf
- https://s3.amazonaws.com/xisefowu/bncc_ensino_medio_em.pdf
- https://cdn.shopify.com/s/files/1/0483/6802/5751/files/momentum_and_energy_equations.pdf
- https://cdn.shopify.com/s/files/1/0484/9929/4363/files/schlage_keypad_lock_user_manual.pdf
- https://cdn.shopify.com/s/files/1/0491/8424/3878/files/62038668115.pdf
- https://cdn.shopify.com/s/files/1/0440/2341/4942/files/8631184559.pdf
- https://cdn.shopify.com/s/files/1/0428/9891/5484/files/adding_and_subtracting_fractions_worksheets_grade_5.pdf
- https://s3.amazonaws.com/purixifusipelid/rivaxakarijezububulu.pdf
- https://s3.amazonaws.com/lewuli/percy_jackson_titans_curse_movie.pdf
- https://s3.amazonaws.com/xapidajovaji/bsc_csit_entrance_result_2076.pdf
- https://cdn.shopify.com/s/files/1/0497/1593/7441/files/19267537537.pdf
- https://cdn.shopify.com/s/files/1/0483/8385/2695/files/kemawanodumavanodeze.pdf
- https://s3.amazonaws.com/vatakefojunib/12253282412.pdf
- https://s3.amazonaws.com/widuxade/costing_and_cost_analysis.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000077dc.bin` `cf5f028a415fe2530c5bf5862507894bd279684f7d08850be253092119ee1c7f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x77DC	5160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.