PDF malware analysis — malicious · 7d59c23db16b01d1

MALICIOUS

PDF

26.0 KB Created: 2020-10-31 09:15:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: af7346d2c3d68e07742c725a73353184 SHA-1: 647e5e72b54298b7a413a34608848c9a240303e3 SHA-256: 7d59c23db16b01d129d62b99b551bf82fb2814931466c6dfcd3692496516a0bb

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, https://ggtraff.ru/aws?keyword=mooligaigal+payangal+in+tamil, is the primary indicator of malicious intent. While no scripts were extracted, the PDF structure and the malicious URL strongly suggest a phishing or malware delivery attempt, likely initiated via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=mooligaigal+payangal+in+tamil
- https://sixapinipuso.weebly.com/uploads/1/3/1/3/131384402/9470672.pdf
- https://pirowefe.weebly.com/uploads/1/3/4/4/134444143/ef5caed.pdf
- https://cdn-cms.f-static.net/uploads/4380229/normal_5f9af6ae6aa3c.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lanorolowu/ropixemipomifig.pdf
- https://s3.amazonaws.com/naxizugenabi/gm_diet_plan_reviews.pdf
- https://uploads.strikinglycdn.com/files/ae60a413-3954-44bc-8577-0c231beb4048/clavecin_de_lpoque_baroque.pdf
- https://uploads.strikinglycdn.com/files/eb4ceb1a-aeb3-4725-b472-5fbdbc57efef/12060587291.pdf
- https://uploads.strikinglycdn.com/files/cb297d5d-80c6-4251-af43-338c5185861c/fixetijagel.pdf
- https://uploads.strikinglycdn.com/files/de474237-1ffa-48a7-b4d7-9dc9ceabed56/vipabatakaselov.pdf
- https://s3.amazonaws.com/nuxulikiwab/nidopipipizabiz.pdf
- https://uploads.strikinglycdn.com/files/da4451df-6ad5-4855-a441-9327f37b8926/pugabarujoja.pdf
- https://uploads.strikinglycdn.com/files/7449076d-e1ce-449d-aea6-b98b91cba603/nibijesuxiburewuk.pdf
- https://uploads.strikinglycdn.com/files/49ab590d-b15e-4144-8f4e-a3c16cd4480e/google_pixel_instruction_manual.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004aa9.bin` `2c084b7b3595243695bf3ee8dff0562a2aa183a7040a62856affc72d6618e1c4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4AA9	4972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.