Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ba03ab97948aefb…

MALICIOUS

PDF

23.8 KB Created: 2020-10-04 20:24:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 808d7c53578224eeeff650b770b5fa48 SHA-1: 1a1655b74ba180122e6d875e02a508d32c7e4449 SHA-256: 7ba03ab97948aefb7fd6daa18a5236b3523b985b25d9276fedb7b1a1d6808138
152 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by multiple heuristics as malicious, specifically for containing a large number of external links, some of which point to known malicious redirector infrastructure. The document body contains a URL that appears to be part of a link farm or SEO manipulation scheme. The primary purpose seems to be to leverage these links for malicious redirection or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=inconsequential+debates+answers+pathfinder+kingmaker In PDF document text
    • http://files.cmshpe.com/uploads/1/3/1/4/131408139/3464979.pdfIn PDF document text
    • http://lewet.gigglesanddreamsabound.com/uploads/1/3/1/3/131380005/5cccd59.pdfIn PDF document text
    • http://gotukow.santekorwestisland.com/uploads/1/3/0/7/130738731/6587110.pdfIn PDF document text
    • http://files.duluthfinepianos.com/uploads/1/3/2/6/132683267/8573274.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7696ad63-0aab-4979-9111-eaaf25472fb9/kajufanon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/776a02fb-d69b-4bfc-98dc-6411e906b914/sojed.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4511ff97-6623-4c90-a66f-f1ba2b77f517/xazabugef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a38819e2-5978-4664-9aea-829075683abf/nibidilev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/842c50ad-a270-4148-86eb-215e2761a590/41297319301.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9ba0a12-6d52-46cc-bff7-59f3410ec8a8/85668239194.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2459570c-770d-4a04-a060-1755832c1acd/pumemupokemamev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/431315c9-5d78-41a0-bdc4-c6e4c58224dd/42504611152.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37c4abca-a7e0-436e-b901-94eaa23a522c/61742007213.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a9d7ea9-a17d-453e-b670-405c7a86b63b/44352944982.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/696f037a-6d4b-4b0e-839f-1bd7603452e7/xoziwarun.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.