Malicious PDF — malware analysis report

Static analysis result for SHA-256 92b80ff7a88d2112…

MALICIOUS

PDF

16.0 KB Created: 2020-10-27 12:59:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 85fe94519246adca2b4d9ac4dfb6fca1 SHA-1: 484e85b06b764d0f62de5c0678aa7156ac1ded05 SHA-256: 92b80ff7a88d21128b4714fce3225c7aac67467814ca6ba5e0bc83410625c99a
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF is an image-only lure designed to trick users into clicking a link, as indicated by the 'PDF_IMAGE_LURE' heuristic. The primary malicious link, 'https://ggtraff.ru/strik?keyword=dell+product+life+cycle', is identified as a malicious redirector. The document also contains a large number of external links, many pointing to PDF files hosted on Shopify, suggesting a link farm or SEO poisoning attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=dell+product+life+cycle In PDF document text
    • https://cdn-cms.f-static.net/uploads/4416671/normal_5f9796d1ddff3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410722/normal_5f933b260592e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374979/normal_5f8d492874df6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365576/normal_5f87d4dd13b0a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380691/normal_5f97c8cf4ff2a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366382/normal_5f89daeac76e9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389370/normal_5f96075c0f722.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/1262/6855/files/zulilabatepobi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/1861/6473/files/charles_taylor_atomism.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/9545/6413/files/nujibakamabobotupowilane.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/0567/6192/files/lixubufe.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/4114/3454/files/harvard_public_library_illinois.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19a1e75e-301f-4255-8ebd-00d55491feb9/padejedefas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9f1d30d-6c03-4149-8996-8993b1c5d7cf/45815103570.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5be8d05e-9923-4136-91c2-5d8ec8105ccd/desepateridativo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b669a0ac-dd87-4cfd-81e8-13c9e3814008/descargar_alcatel_mobile_upgrade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9993ce6-634c-43d9-afe1-de7fc8a4204e/30107114192.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/9128/8767/files/gafobavox.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/6875/1523/files/physics_chapter_9_test_energy_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0491/7038/3014/files/platelets_function_test.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/9168/0150/files/33497438336.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.