Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c772dc0a792de94…

MALICIOUS

PDF

31.1 KB Created: 2020-10-27 11:44:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e50d0895ee2a2716b013f030a4dec9e SHA-1: 156eedf7f574831630a4673f330e87b3ee0d01b6 SHA-256: 4c772dc0a792de94cddfca59f6220e12ab92affbd47341d3937128a14d0bc84e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains a link that redirects to known malicious infrastructure, identified by the URL 'https://cctraff.ru/strik?keyword=dsc+degree+in+usa'. The document body, though heavily obfuscated, contains this URL and text suggesting a lure related to a "Dsc degree in usa". The presence of numerous external PDF links, many pointing to S3 buckets, further indicates a link farm or SEO poisoning attempt to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=dsc+degree+in+usa
    • https://cdn-cms.f-static.net/uploads/4374976/normal_5f8bdfb1b07c6.pdf
    • https://cdn-cms.f-static.net/uploads/4372080/normal_5f8ca133af6af.pdf
    • https://cdn-cms.f-static.net/uploads/4369143/normal_5f88be9c6fdcc.pdf
    • https://mizunawakore.weebly.com/uploads/1/3/1/4/131406356/1004048a89f5.pdf
    • https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/4040610.pdf
    • https://jixepelisu.weebly.com/uploads/1/3/2/6/132695865/dedanolimivobejidane.pdf
    • https://zadavutuni.weebly.com/uploads/1/3/4/3/134343582/aad02d15945bb.pdf
    • https://samomalekadoj.weebly.com/uploads/1/3/1/4/131438786/1751376.pdf
    • https://s3.amazonaws.com/dudigonifu/catalogo_avon_campagna_16_2017.pdf
    • https://s3.amazonaws.com/zategafozasiru/joganabudozafifedenire.pdf
    • https://s3.amazonaws.com/damerirazib/rorobiwowepawetilufisuzi.pdf
    • https://s3.amazonaws.com/guwutivupudutu/electric_car_industry_analysis.pdf
    • https://s3.amazonaws.com/felasorarabipis/56144960467.pdf
    • https://s3.amazonaws.com/lebaxa/wevutikedovutamilisuzem.pdf
    • https://s3.amazonaws.com/vixuwogetiv/75808422063.pdf
    • https://cdn.shopify.com/s/files/1/0484/4440/7966/files/funet.pdf
    • https://cdn.shopify.com/s/files/1/0483/5518/0695/files/real_car_parking_games_for_android.pdf
    • https://cdn.shopify.com/s/files/1/0434/6026/4096/files/mppeh_nko_answers.pdf
    • https://cdn.shopify.com/s/files/1/0266/9124/0122/files/94124435528.pdf
    • https://cdn.shopify.com/s/files/1/0495/9010/8326/files/ffxiv_dafangshi_location.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.