PDF malware analysis — malicious · 96121f80a04616e0

MALICIOUS

PDF

34.7 KB Created: 2020-11-09 16:24:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4fd7a71404ee8d3891d0d45b372b2552 SHA-1: 4aba92ef71038d775684d8939331407f4e7cf4b7 SHA-256: 96121f80a04616e0fc4b8e37ec7c71c81d816470e83b8e14b7f39a2f08756f7c

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which are embedded within the document body and presented as a link farm. The primary URL, 'https://traffset.ru/strik?keyword=how+to+delete+google+auto+backup+photos', suggests a lure to trick users into clicking on potentially malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?keyword=how+to+delete+google+auto+backup+photos
- https://cdn-cms.f-static.net/uploads/4406806/normal_5f9958c1abc93.pdf
- https://vepaxanejabag.weebly.com/uploads/1/3/4/3/134317352/rimatonanedepun.pdf
- https://cdn-cms.f-static.net/uploads/4368777/normal_5f9a8293798eb.pdf
- https://mojipodo.weebly.com/uploads/1/3/4/5/134592530/nunumobeveboxumepes.pdf
- https://mefemanodi.weebly.com/uploads/1/3/1/4/131454269/1067983.pdf
- https://cdn-cms.f-static.net/uploads/4448345/normal_5f9ea88aad12f.pdf
- https://cdn-cms.f-static.net/uploads/4404523/normal_5f96e4dc33732.pdf
- https://cdn-cms.f-static.net/uploads/4368219/normal_5f8c48c7a0b62.pdf
- https://cdn-cms.f-static.net/uploads/4372100/normal_5f9c68bfef4c0.pdf
- https://cdn-cms.f-static.net/uploads/4369928/normal_5f99747e22ca8.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/da2e3be5-d9a1-4d96-aff4-c4ae183f719d/35240483294.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005cee.bin` `ec2f380c586c6272c785511140c578956271d772d22c01cc6d8f000c40ad0cd9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5CEE	5496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.