PDF malware analysis — malicious · 6c4674508ce182ae

MALICIOUS

PDF

16.0 KB Created: 2020-11-06 12:58:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 203cf26664a0f49f2e78c549b45b1f4c SHA-1: b68576d84dc2943b5a28eccb5b689cb41ec8ac2a SHA-256: 6c4674508ce182aecb354174972cc51d366038cd3db0e7acb41fab70c99e9cfa

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical of phishing attacks, designed to trick users into clicking a link. The embedded link `https://cctraff.ru/123?keyword=how+to+sign+apk` is flagged as malicious redirector infrastructure. Additionally, the PDF contains a link farm with numerous external PDF links, suggesting SEO manipulation for traffic generation. No scripts were extracted, but the overall structure and malicious link indicate a phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9981

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/123?keyword=how+to+sign+apk
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/07041847.pdf
- https://s3.amazonaws.com/bugutaj/kurubakorezid.pdf
- https://s3.amazonaws.com/lejivugeleguwod/diy_canister_filter_5_gallon_bucket.pdf
- https://uploads.strikinglycdn.com/files/1bc2ef1f-9b48-4fe2-8318-9a590ffb485d/fijomovazu.pdf
- https://s3.amazonaws.com/migivewuwe/44601172846.pdf
- https://s3.amazonaws.com/subud/nukeposezekulemonozen.pdf
- https://uploads.strikinglycdn.com/files/4f23a6f5-4127-44b9-93b9-2be6b105ef0f/86591595078.pdf
- https://s3.amazonaws.com/fogibi/bajiliv.pdf
- https://uploads.strikinglycdn.com/files/da6f4837-cb24-4bda-904a-9abc2a8aadd9/dnd_5e_grung_monk.pdf
- https://uploads.strikinglycdn.com/files/3cde9c92-807a-46d7-8948-934011e3a57a/wepejifenefaxi.pdf
- https://s3.amazonaws.com/wukara/62881562847.pdf
- https://s3.amazonaws.com/tadovu/61413271830.pdf
- https://s3.amazonaws.com/mexesazaxasa/choosing_the_right_word_unit_8.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.