PDF malware analysis — malicious · 47e0e6d1b0a36093

MALICIOUS

PDF

48.6 KB Created: 2020-12-21 14:41:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ff6de8953402fd51d4c35d4340f69e30 SHA-1: 8cddb1c4ca6650696fe4775c98112aa79811d01d SHA-256: 47e0e6d1b0a360934b9264f9271df12e1648d10419bc5f664b24711b1e43960c

242 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, many of which point to known malicious redirector infrastructure or disposable hosting. The primary malicious link identified is https://cctraff.ru/strik?utm_term=truck+jump+start+brisbane, which is likely intended to lead the user to a phishing or malware distribution site. The document's structure and content suggest it is part of a link farm designed to generate traffic and potentially phish users.

Machine Learning

Nyx PDF Classifier malicious score 0.8544

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?utm_term=truck+jump+start+brisbane
- https://cdn-cms.f-static.net/uploads/4374957/normal_5f8af32dcce3b.pdf
- https://segakimorepej.weebly.com/uploads/1/3/0/7/130738797/jijexukiwixapafev.pdf
- https://cdn-cms.f-static.net/uploads/4467027/normal_5faecdd744332.pdf
- https://nigomiboxamu.weebly.com/uploads/1/3/1/1/131163879/seniletope-lukigagefe-menuzikosefavap.pdf
- https://wivujawa.weebly.com/uploads/1/3/4/5/134582083/gigosapuso.pdf
- https://rojumiladikeju.weebly.com/uploads/1/3/4/3/134315163/vumikudagig-zawojokuja-pajubupo.pdf
- https://cdn-cms.f-static.net/uploads/4444655/normal_5fa35e49db20a.pdf
- https://jodotabamusunew.weebly.com/uploads/1/3/4/4/134402052/5d8ea259c6d.pdf
- https://static1.squarespace.com/static/5fc2b4fb104edf1d778c99fd/t/5fc85dc97ff5a343ebf32db4/1606966730118/korufebod.pdf
- https://s3.amazonaws.com/pisedij/hairstyles_side_bangs_2019.pdf
- https://s3.amazonaws.com/migivewuwe/52245541981.pdf
- https://s3.amazonaws.com/regegozumekoza/mogun.pdf
- https://static1.squarespace.com/static/5fc4d18a7848ba205d31d661/t/5fcb53a321c0486e9192b4cc/1607160740411/download_game_my_talking_tom_angela_apk.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.