Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdda3df11a75ffba…

MALICIOUS

PDF

32.2 KB Created: 2020-10-01 20:18:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 0fde34fe4c01183b34dd750736c85d5e SHA-1: d1be0c202e5a17243fbb6482d16f9f6ab7ec8af6 SHA-256: bdda3df11a75ffbadd54afd6f7308e09640115f0bde3911bb38c52ab5030da13
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links to external websites, many of which are part of a link farm designed to appear as legitimate documents. The primary malicious link, 'https://ggtraff.ru/strik?keyword=attestation+d%2527+h%25C3%25A9bergement+prefecture+mayotte+pdf', is identified as a redirector to malicious infrastructure. The ML classifier strongly indicates malicious intent, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=attestation+d%2527+h%25C3%25A9bergement+prefecture+mayotte+pdf In PDF document text
    • http://files.mygosolartoday.com/uploads/1/3/2/8/132816117/1522935.pdfIn PDF document text
    • http://moluve.inspiredbyyoujewelry.net/uploads/1/3/1/8/131856554/6791960.pdfIn PDF document text
    • http://files.brisafinancial.com/uploads/1/3/2/6/132682882/pegelikotojukasuz.pdfIn PDF document text
    • https://site-1038338.mozfiles.com/files/1038338/92797792951.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67c5017b-1254-4bb8-8c4e-eea65339395c/taxakemumu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1cfc8a57-2b2e-45d9-9f65-afcdc41dde0b/71303802016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7060c68b-3715-4931-84d6-9c7cd386ceb6/72945634076.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98a1dfb6-0fce-4025-a8c0-2bc9c44c1e10/rutonamitutenuzoxatebu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a937a5fc-0b80-4693-b063-18db1456a764/66404452616.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65722e07-1e49-4c39-a578-ef877b2fdd03/wesorexepovasumarof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/765002b4-ce78-4da3-9376-402776b820f3/46396974957.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.