Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ba21ffc20a243e8…

MALICIOUS

PDF

50.6 KB Created: 2020-11-11 06:05:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bd993d907232754091b9bdd75a285a96 SHA-1: ec0d41a8213d040c941a14c8afa496209aa61c59 SHA-256: 7ba21ffc20a243e84fd5c6b3e53283e3e90cf6bd8118aa509fa804466da2a65f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The primary malicious URL identified is https://cctraff.ru/aws?keyword=you+magazine+uk. While no scripts were explicitly extracted, the PDF structure and the malicious URL suggest an attempt to lure the user to a compromised site, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9443

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=you+magazine+uk
    • https://cdn-cms.f-static.net/uploads/4384160/normal_5f8ddd8561e51.pdf
    • https://cdn-cms.f-static.net/uploads/4393761/normal_5fa7d68d6aa78.pdf
    • https://cdn-cms.f-static.net/uploads/4371004/normal_5f8e05fa1121b.pdf
    • https://cdn-cms.f-static.net/uploads/4413113/normal_5fa25100c0f1a.pdf
    • https://uploads.strikinglycdn.com/files/da0b9327-f473-4d84-a544-ce4bd154587d/kuzosoravud.pdf
    • https://s3.amazonaws.com/fufaragebo/thus_spake_zarathustra_by_friedrich_nietzsche.pdf
    • https://uploads.strikinglycdn.com/files/384999a6-4fc9-47ce-8319-1ec89f1ab74a/79554557853.pdf
    • https://uploads.strikinglycdn.com/files/14039491-23c5-441b-b329-06bcbd0435cc/best_buy_lawrenceville_ga.pdf
    • https://uploads.strikinglycdn.com/files/b9566308-7967-458c-a0e3-7c8658f93a7b/7563970681.pdf
    • https://uploads.strikinglycdn.com/files/aa11e081-beb3-4d1d-8da0-6cede273b284/letujumuboziwamokafus.pdf
    • https://s3.amazonaws.com/lupuvogotog/39757165881.pdf
    • https://s3.amazonaws.com/napisakaluja/xufufalarimilapipag.pdf
    • https://uploads.strikinglycdn.com/files/6f90d5f3-3e45-4063-8f45-e37d9e94aa2b/gegadoterezabazusikemafon.pdf
    • https://uploads.strikinglycdn.com/files/52882967-619d-4745-b27a-10da1942c2d7/sulebori.pdf
    • https://s3.amazonaws.com/zonebon/draenor_mining_guide.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.