Malicious PDF — malware analysis report

Static analysis result for SHA-256 b43fc6a0010b2528…

MALICIOUS

PDF

27.6 KB Created: 2020-10-04 01:44:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: de979ad5320c4ff690d567afeba915f8 SHA-1: 8f668e97d19a2ca2c8b211e54fcc8dcc28d0a667 SHA-256: b43fc6a0010b252841ae00680446baf09398c380981e3e04ff0ff50cbbae9b16
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, many of which point to a redirector URL known for malicious activity. The document body, though heavily obfuscated, contains the same malicious URL. This suggests the primary goal is to redirect the user to a malicious site, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=kmno4+and+oxalic+acid+titration+pdf In PDF document text
    • http://mefozaneb.litturi-photography.com/uploads/1/3/2/7/132710567/rijusiwub.pdfIn PDF document text
    • http://files.coolkingindia.com/uploads/1/3/2/6/132695336/2592079.pdfIn PDF document text
    • http://files.saturdayplayhouse.com/uploads/1/3/1/4/131482823/nakelidukivisavo.pdfIn PDF document text
    • http://files.paredeslawoffice.com/uploads/1/3/0/8/130874039/dimokofi_nibivuzuka.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/8544/7833/files/what_is_this_thing_called_science.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/6864/0418/files/19890159116.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/9778/0127/files/southern_high_school_nc.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/5323/9457/files/sazoxopegoxu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/3528/6943/files/7.1_practice_c_geometry_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/3429/1609/files/pogil_answer_key_ap_biology_control_of_gene_expression_in_prokaryotes.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/4667/2805/files/nuzatuziwekabuvabamusak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb2a1eeb-d279-4feb-89d5-bc9659850bf9/napokudef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8218d55-93df-4b5d-8d77-c32cbe313bbf/56406540314.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4a1b0eb-6f19-41da-a692-f43cf2d681da/pudewupajuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f8f3ce1-3309-4524-9bde-3cd7ff141afd/41793953535.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dca56f93-00b6-42a6-82c3-ba4343689839/mupuzusufaletedaxovi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.