PDF malware analysis — malicious · 8c0677036243e055

MALICIOUS

PDF

40.6 KB Created: 2020-10-25 23:08:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e1c67d38e6a685deeb4d59ffad533b87 SHA-1: b9ec81dcaad33d45b9b075aba9142deda4ae8766 SHA-256: 8c0677036243e055828563d8e1071e8dec3ef802922878863870f5ed7e18a970

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains embedded links that point to known malicious redirector infrastructure and a large number of other PDF files. This suggests a tactic to manipulate search engine results or to distribute further malicious content. The primary malicious URL identified is https://cctraff.ru/wb?keyword=oraciones%20coordinadas%20para%20analizar%20pdf, which is flagged as a malicious redirector.

Machine Learning

Nyx PDF Classifier malicious score 0.9972

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/wb?keyword=oraciones%20coordinadas%20para%20analizar%20pdf
- https://cdn-cms.f-static.net/uploads/4368731/normal_5f8c63ef6ef72.pdf
- https://cdn-cms.f-static.net/uploads/4366388/normal_5f875b57d00b0.pdf
- https://cdn-cms.f-static.net/uploads/4392649/normal_5f904d04484ae.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f8953ab77c01.pdf
- https://cdn-cms.f-static.net/uploads/4381340/normal_5f8d172313118.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/d0179cf3-8382-4ef0-85bc-e9ea42ff4c80/wenim.pdf
- https://uploads.strikinglycdn.com/files/43ff274f-fce4-4cfe-93b5-2f448334dab2/miwarivataxokezuluw.pdf
- https://uploads.strikinglycdn.com/files/94414a62-fe10-4d5f-9a48-f2b3e63b9339/alligation_and_mixture_problems.pdf
- https://s3.amazonaws.com/jozetej/the_iliad_with_line_numbers.pdf
- https://s3.amazonaws.com/purixifusipelid/assessment_center_que_es.pdf
- https://s3.amazonaws.com/memul/gibenozidiw.pdf
- https://s3.amazonaws.com/wuniku/apocrypha_bible.pdf
- https://cdn.shopify.com/s/files/1/0266/8514/5277/files/98334972071.pdf
- https://cdn.shopify.com/s/files/1/0436/4474/7929/files/lego_remote_control_cargo_train.pdf
- https://cdn.shopify.com/s/files/1/0428/2905/4118/files/juggalo_face_paint_app.pdf
- https://cdn.shopify.com/s/files/1/0501/9821/6858/files/97430984731.pdf
- https://cdn.shopify.com/s/files/1/0492/0079/1715/files/sika_dwa_kofi_means.pdf
- https://cdn.shopify.com/s/files/1/0484/8995/5489/files/virex_tb_instructions_for_use.pdf
- https://cdn.shopify.com/s/files/1/0437/2683/1784/files/chemistry_handwritten_notes_for_ssc_cgl.pdf
- https://cdn.shopify.com/s/files/1/0484/3680/5800/files/xonalonugub.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006037.bin` `924e27989b07419a8dc9669946644d6041e9a966c163cb9982a166bfa424f660`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6037	5224 bytes
`font_01_sfnt_off0000720c.bin` `4fc9d02c76d62cb940b59faebe4717c0f5cae21f4e7494ba02bb422c42d9c055`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x720C	10984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.