PDF malware analysis — malicious · 9528893b974e1f63

MALICIOUS

PDF

64.0 KB Created: 2020-12-19 23:42:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8c70426c6438f6896f3151d6af06b8ee SHA-1: 32439ddf1f6043bacb01589ade9c1c09e6674516 SHA-256: 9528893b974e1f63ce3a9e8b44a9d45aa7dddaef9520bcbaf26e922d07b3fa35

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains heuristics indicating it is part of a link farm and is flagged as malicious by ML classifiers and ClamAV. The document body, though truncated, suggests a lure related to 'Mpow 059 bluetooth headphones review'. The primary external URI points to 'https://traffine.ru/strik', which is likely the malicious destination.

Machine Learning

Nyx PDF Classifier malicious score 0.8201

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffine.ru/strik?utm_term=mpow+059+bluetooth+headphones+review
- https://zekuwatifakaxi.weebly.com/uploads/1/3/2/8/132815855/risabibal-zebuwovaweb.pdf
- https://vodexekuteb.weebly.com/uploads/1/3/0/7/130776001/7620467.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/edecb2af-c253-4140-bd5e-99c17ca3d5b3/2876368089.pdf
- https://uploads.strikinglycdn.com/files/ca32823d-c36a-4dc8-86be-ad70c8f4bfa2/49096319661.pdf
- https://uploads.strikinglycdn.com/files/afb4b6af-3fec-45cf-8c03-41be1f180329/89789590382.pdf
- https://uploads.strikinglycdn.com/files/bb4431c4-ea8a-46a3-ae05-21829ba257d3/shall_vs_should_engineering.pdf
- https://uploads.strikinglycdn.com/files/6fa58c4a-9319-469a-8be9-02a5c4a34496/la_culebra_song.pdf
- https://uploads.strikinglycdn.com/files/d0e192c1-730b-407b-8c77-a5f85565d8de/nirrti_destiny_child.pdf
- https://uploads.strikinglycdn.com/files/45fc1a03-84b1-4fca-aae4-7d710f1fee51/35168426351.pdf
- https://uploads.strikinglycdn.com/files/bf8ca7f6-b2eb-42e4-8857-a47f5e29f70e/nuxamu.pdf
- https://s3.amazonaws.com/fejakixoweka/61820019433.pdf
- https://uploads.strikinglycdn.com/files/10d74112-dc89-40ee-bd44-071980d8e0a4/kepigofaxipit.pdf
- https://uploads.strikinglycdn.com/files/0ff98285-2977-4f01-a734-03b36eda0f5f/fear_and_loathing_in_las_vegas_free_online_stream.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc05.bin` `12b30284d2a5cc474eb2b592e44edf7f4162355d922b930867f1428246a1070f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC05	5764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.