PDF malware analysis — malicious · b1d824de251efffd

MALICIOUS

PDF

26.0 KB Created: 2020-11-08 00:17:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6750a039cfa2b65cb8c9e87ba8395c86 SHA-1: 0e269bc082ada4330929c4eb47221446229c5bf1 SHA-256: b1d824de251efffdf89cea914a96ecd11f61efd292c5d2178eed0de10c4a6a8f

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a significant number of embedded links, with many pointing to external PDF files hosted on various platforms. One URL, https://cctraff.ru/aws?keyword=crb+index+data, is flagged as a known malicious redirector. This suggests the document is likely part of an SEO link farm or a content-spinning operation designed to distribute malicious content or manipulate search engine rankings. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9972

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?keyword=crb+index+data
- https://gesefamuredoxuk.weebly.com/uploads/1/3/4/6/134631359/wosolu.pdf
- https://zofitebe.files.wordpress.com/2020/11/jifikubopelilifu.pdf
- https://nawavexox.files.wordpress.com/2020/11/sirunuzap.pdf
- https://sevuropigo.files.wordpress.com/2020/11/lofukugawux.pdf
- https://fovodifikade.files.wordpress.com/2020/11/97165494951.pdf
- https://zozozalugid.files.wordpress.com/2020/11/bedelukidunewifitor.pdf
- https://s3.amazonaws.com/gavexilatuvitaz/23901565211.pdf
- https://remetipokuv.files.wordpress.com/2020/11/47008163834.pdf
- https://s3.amazonaws.com/zomuzigo/16928292265.pdf
- https://zumuwuvebib.files.wordpress.com/2020/11/53462806778.pdf
- https://mepugen.files.wordpress.com/2020/11/factoraje_financiero_derecho_mercantil.pdf
- https://negolakone.files.wordpress.com/2020/11/68314913009.pdf
- https://tilemidif.files.wordpress.com/2020/11/68187594713.pdf
- https://serabeluf.files.wordpress.com/2020/11/tigerheart27_s_shadow.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.