PDF malware analysis — malicious · 7de47657e5afbe96

MALICIOUS

PDF

37.8 KB Created: 2020-11-05 04:35:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07

MD5: 9577804cb019b738b149b57f26b7edfb SHA-1: 32dae6952b43e0bb252358902b65387b08089b16 SHA-256: 7de47657e5afbe960c46ad8608e3a58eaff8384aaf270b7d0504e77c0d0fab8c

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://cctraff.ru/strik?keyword=lipid+used+for+energy+storage', is the primary indicator of malicious intent. The document body, though heavily obfuscated, contains this URL, suggesting an attempt to lure the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=lipid+used+for+energy+storage In PDF document text
- https://wefolukozik.weebly.com/uploads/1/3/1/4/131406413/2747180.pdfIn PDF document text
- https://sazojowob.weebly.com/uploads/1/3/4/3/134351878/juwaturax-sarovukuwuraf.pdfIn PDF document text
- https://kirugivedipabaw.weebly.com/uploads/1/3/4/4/134464293/4b6212ad.pdfIn PDF document text
- https://tenasedoba.weebly.com/uploads/1/3/4/3/134333827/xusun_pedokigosepeja.pdfIn PDF document text
- https://tumekisegazuf.weebly.com/uploads/1/3/4/6/134611428/2808613.pdfIn PDF document text
- https://donixefafara.weebly.com/uploads/1/3/4/3/134310569/sebavo-dujemujanosajaw-direvozeguk-jaxuwe.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369514/normal_5f939ebb3f794.pdfIn PDF document text
- https://bonifivudinuf.weebly.com/uploads/1/3/4/3/134305406/lapebesizejes_wowewuga_jafolip_jepugiwir.pdfIn PDF document text
- https://wanezetisozol.weebly.com/uploads/1/3/4/4/134468493/3562529.pdfIn PDF document text
- http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/dejolavubukugeb/29917368814.pdfIn PDF document text
- https://s3.amazonaws.com/nowonovege/nafipevigoxa.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007d3d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D3D	1540 bytes
SHA-256: `ab8d567ab81c0bd2bcc3db4200db5c4723eaa09514c3a44edf93d1c21d5b5e3e`
`font_01_sfnt_off0000851f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x851F	5220 bytes
SHA-256: `2a921a6602011973b4009aec1011fe389fa22931ddd3cc387dfa2861b75fff38`

Open this report in the interactive analyzer, or submit your own file for analysis.