PDF malware analysis — malicious · bcb1150a235e1e9f

MALICIOUS

PDF

32.0 KB Created: 2020-10-25 22:05:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b1d77b90227ff622de59cab7d4ffc03b SHA-1: facc45434350fecbc0254fed4c4ddef089401b6a SHA-256: bcb1150a235e1e9fafe9afc083c078c2cb7495fe51d00b2483a8939ec1601fbb

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with at least one identified as a malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' indicate a deliberate attempt to direct users to potentially harmful external content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/123?keyword=que+es+un+bovino+pdf
- https://cdn-cms.f-static.net/uploads/4388050/normal_5f9301d292a2f.pdf
- https://cdn-cms.f-static.net/uploads/4385417/normal_5f926c8d2c4ea.pdf
- https://cdn-cms.f-static.net/uploads/4368496/normal_5f8dc60831b76.pdf
- https://cdn-cms.f-static.net/uploads/4368492/normal_5f891c9373243.pdf
- https://cdn-cms.f-static.net/uploads/4367268/normal_5f8bbbfb6d148.pdf
- https://cdn-cms.f-static.net/uploads/4369511/normal_5f8e35aaaf3c8.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/c29d9a24-bfbd-4416-b584-dccb8aa176fa/14265485477.pdf
- https://uploads.strikinglycdn.com/files/ec354057-1d68-4a1f-8863-b03b40cc01ca/83752192450.pdf
- https://cdn.shopify.com/s/files/1/0429/9204/2137/files/the_legend_of_zelda_phantom_hourglass_manual.pdf
- https://cdn.shopify.com/s/files/1/0480/8245/2644/files/lavuvukofenumozex.pdf
- https://cdn.shopify.com/s/files/1/0496/7232/3228/files/sony_tv_remote_app_apk_download.pdf
- https://cdn.shopify.com/s/files/1/0266/9209/2102/files/dds_manual_2018.pdf
- https://uploads.strikinglycdn.com/files/e3c0d99e-ebab-4a59-97b8-db0c292a06e3/givakaxobagekowazamafixis.pdf
- https://uploads.strikinglycdn.com/files/779f54ac-9942-4202-8831-69e92f8baee8/35994897169.pdf
- https://uploads.strikinglycdn.com/files/ca50747b-b155-4ebf-bbd5-308f4d055c9a/56514787677.pdf
- https://uploads.strikinglycdn.com/files/ddab490c-756a-4c0b-bc44-869fcbb59a3e/5433583052.pdf
- https://uploads.strikinglycdn.com/files/601c0887-4b65-414c-987e-5f4526108d5f/70537505945.pdf
- https://uploads.strikinglycdn.com/files/fe725621-85bf-4c86-92dc-59ad9d7ee6ce/delawu.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006c60.bin` `c519e3e302ac0be2f0dc24c6182d4b3d3c6bb85f6d18dabd0e23f28e71fc17f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C60	4960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.