PDF malware analysis — malicious · c20865eeb64882ca

MALICIOUS

PDF

84.6 KB Created: 2020-11-10 12:06:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2c718ab0e27124f2076d7983800ae435 SHA-1: 8d480da9aae781d7e297b795538767b09441957f SHA-256: c20865eeb64882ca70ad6402c591688faecd0feda6f263e6c212dc8865e79e96

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://ggtraff.ru/strik?keyword=bmw+e46+m3+smg+to+manual+conversion+cost', is identified as malicious. The ML classifier and ClamAV detection further support the malicious nature of this file, suggesting it's a phishing or trojan delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.8057

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?keyword=bmw+e46+m3+smg+to+manual+conversion+cost
- https://cdn-cms.f-static.net/uploads/4446646/normal_5fa89f04b918b.pdf
- https://cdn-cms.f-static.net/uploads/4372104/normal_5f92470b4645f.pdf
- https://cdn-cms.f-static.net/uploads/4410976/normal_5f97781e59cc1.pdf
- https://cdn-cms.f-static.net/uploads/4387814/normal_5f9a7a178da9a.pdf
- https://cdn-cms.f-static.net/uploads/4426972/normal_5f992034d46f4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/22e78ddf-3875-4dde-8876-fbb3a29b3f28/suboxofozobuxuxa.pdf
- https://s3.amazonaws.com/bejenosugede/29417601662.pdf
- https://s3.amazonaws.com/susopuzupure/edema_agudo_pulmonar_medigraphic.pdf
- https://s3.amazonaws.com/xanebavifamopez/kamugofeviti.pdf
- https://s3.amazonaws.com/bovenotojitowe/does_the_beauty_angel_rvt_30_work.pdf
- https://uploads.strikinglycdn.com/files/0fe7ec74-9b2c-41ce-ad57-3c42f8d7fb11/rukujagaze.pdf
- https://s3.amazonaws.com/piwanisaj/zumezetovaderix.pdf
- https://uploads.strikinglycdn.com/files/0cf80f2e-3a88-4575-82e1-146a79f66ed5/disney_roku_login.pdf
- https://s3.amazonaws.com/forupokisip/6328749640.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000128fb.bin` `39822885cbc91f18ee9455be112c1db35a2178a28fa42bbb14b911ef478c7cc8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x128FB	5728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.