Malicious PDF — malware analysis report

Static analysis result for SHA-256 84e8917d5b4868d3…

MALICIOUS

PDF

18.8 KB Created: 2020-10-13 02:54:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c7990c7d5329d8b76583ba9ed9da3a96 SHA-1: 8b6666faaa633454fe894e87bc5a50fd6f4b2b59 SHA-256: 84e8917d5b4868d3bafb6463b3041ae945f62a9202a82aa6c480062c75b16020
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links that are part of a link farm, with one specific URL identified as a malicious redirector. The document body, though heavily obfuscated, contains text referencing "Followers for twitter premium apk" and the malicious URL, suggesting a social engineering lure. The presence of numerous external PDF links further indicates a SEO-based spamming or link farm operation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=followers%252B+for+twitter+premium+apk
    • http://files.thebirthdaywagon.org/uploads/1/3/0/9/130969851/bevubidadexitux.pdf
    • http://files.joystondsouza.com/uploads/1/3/0/9/130968912/6283a57221d1b5.pdf
    • http://lixoxewe.soulhealthservices.com.au/uploads/1/3/0/7/130739291/fizoresivifaxut-zakuvodus-sijedap-sitona.pdf
    • http://zevodib.almaturner.com/uploads/1/3/1/6/131637432/danos-kafiwewozejim-javadorusijodix.pdf
    • http://files.kitakoreatour.com/uploads/1/3/0/7/130775878/1dfc5ec48a80.pdf
    • https://site-1037204.mozfiles.com/files/1037204/75922418287.pdf
    • https://site-1041081.mozfiles.com/files/1041081/74494225408.pdf
    • https://uploads.strikinglycdn.com/files/4174d447-c30b-4457-9ff6-14e1626016b8/tiwefizevixodew.pdf
    • https://uploads.strikinglycdn.com/files/786aa5d3-0179-4db8-a3fe-6355c70954b6/lanapolofududufeweboxote.pdf
    • https://uploads.strikinglycdn.com/files/54d3b2c6-e3b3-4029-bab3-b2a949763f2a/guxomibeluge.pdf
    • https://uploads.strikinglycdn.com/files/5d0f91fa-8bec-493b-b399-a7d4ec6b86c1/miwabusosudelurizinevo.pdf
    • https://uploads.strikinglycdn.com/files/e94facbe-b0d4-41c6-92e7-23bdf957ad01/36679571365.pdf
    • https://uploads.strikinglycdn.com/files/c866ae3d-8dd0-4981-8b04-f98505fc6dab/79326250911.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.