PDF malware analysis — malicious · 6808f07a6bd33392

MALICIOUS

PDF

26.0 KB Created: 2020-11-05 15:49:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4cc1d117f96f6213ec0e10acdd4fd09c SHA-1: 3b880fd9239c4d88e80db61a3e8ff6b5455c390f SHA-256: 6808f07a6bd333923a83e065582a7ff4a014c0e43a83141f1e35d1756649c337

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains multiple embedded links that redirect to potentially malicious infrastructure, as indicated by the 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic. The document body, though heavily obfuscated, contains a URL that is also flagged as a redirector. The ML classifier also strongly indicated maliciousness. The primary attack pattern involves luring the user to malicious sites via embedded links, likely as part of a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?keyword=thank+god+for+the+cleansing+blood+lyrics
- https://jumofawulagap.weebly.com/uploads/1/3/4/4/134486933/6002850.pdf
- https://xepajozojiv.weebly.com/uploads/1/3/4/4/134476610/siroz.pdf
- https://cdn-cms.f-static.net/uploads/4386594/normal_5f9e15862b417.pdf
- https://cdn-cms.f-static.net/uploads/4377112/normal_5f95cdaa92bf9.pdf
- https://genamimiwovem.weebly.com/uploads/1/3/1/6/131636881/1362008.pdf
- https://cdn-cms.f-static.net/uploads/4402963/normal_5f97017b199da.pdf
- https://vonubaxuted.weebly.com/uploads/1/3/1/4/131452839/xusilepevi.pdf
- https://botomaluxezevip.weebly.com/uploads/1/3/4/3/134340767/kidem-bibifipuzabin-tirafenediroba.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/xelikanotuzifaja.pdf
- https://zafitageleg.weebly.com/uploads/1/3/4/4/134489703/4243535.pdf
- https://cdn-cms.f-static.net/uploads/4376599/normal_5f92dcf114c7a.pdf
- https://cdn-cms.f-static.net/uploads/4377414/normal_5f9e1a93055c1.pdf
- https://vumorusumanipav.weebly.com/uploads/1/3/4/2/134234742/bogojeta-bugigunafagopas-lukolalutoxej.pdf
- https://cdn-cms.f-static.net/uploads/4369330/normal_5f87da5e2b3de.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.