PDF malware analysis — malicious · 6d87110f404e65b3

MALICIOUS

PDF

16.0 KB Created: 2020-11-05 08:11:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8ffff6ea32b09b9dd943880900f36762 SHA-1: ac854b37e3dfc386d7d196fcb85b24ed01376ec9 SHA-256: 6d87110f404e65b300885b372198fc5aa23d56c6f733a8ee2c3a53c9b1da845a

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains multiple embedded links, one of which points to a known malicious redirector. The document body, though obfuscated, contains a URL that is also present in the heuristics as a malicious redirector. This suggests the primary purpose is to redirect users to malicious infrastructure, likely for further payload delivery or phishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?keyword=how+to+get+to+cinnabar+island+red
- https://cdn-cms.f-static.net/uploads/4377931/normal_5f8a560d86477.pdf
- https://busozovamifolak.weebly.com/uploads/1/3/4/2/134235369/6a35ef.pdf
- https://cdn-cms.f-static.net/uploads/4413239/normal_5fa1ef88c1a85.pdf
- https://cdn-cms.f-static.net/uploads/4405654/normal_5f951f55334ea.pdf
- https://cdn-cms.f-static.net/uploads/4366027/normal_5f91b512e8fc9.pdf
- https://cdn-cms.f-static.net/uploads/4424991/normal_5fa180f0eb7cc.pdf
- https://cdn-cms.f-static.net/uploads/4369328/normal_5f896b3807d8b.pdf
- https://cdn-cms.f-static.net/uploads/4388819/normal_5f8d893fd6790.pdf
- https://cdn-cms.f-static.net/uploads/4379241/normal_5f8ab4ae90be3.pdf
- https://uploads.strikinglycdn.com/files/669b6bbf-ba9c-4f00-85c9-f14c311aac1d/xazububisemotozatadulanot.pdf
- https://uploads.strikinglycdn.com/files/fd6ed736-6706-464c-9d7e-e17c05788269/sademelo.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.